Merge pull request #11604 from fidencio/release/3.19.1

release: Bump version to 3.19.1
2026-03-05 20:32:19 +00:00 · 2025-07-22 09:00:15 +02:00 · 2025-07-21 20:09:21 +02:00 · 2025-07-21 18:58:56 +01:00 · 2025-07-21 18:50:01 +01:00 · 2025-07-21 12:50:38 +00:00
156 changed files with 6592 additions and 10253 deletions
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -19,7 +19,6 @@ self-hosted-runner:
    - metrics
    - ppc64le
    - riscv-builder
-    - sev
    - sev-snp
    - s390x
    - s390x-large
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -36,9 +36,6 @@ updates:
    # create groups for common dependencies, so they can all go in a single PR
    # We can extend this as we see more frequent groups
    groups:
-      atty:
-        patterns:
-          - atty
      bit-vec:
        patterns:
          - bit-vec
--- a/.github/workflows/build-kata-static-tarball-amd64.yaml
+++ b/.github/workflows/build-kata-static-tarball-amd64.yaml
@@ -168,8 +168,8 @@ jobs:
          - rootfs-image-mariner
          - rootfs-initrd
          - rootfs-initrd-confidential
-          - rootfs-nvidia-gpu-initrd
-          - rootfs-nvidia-gpu-confidential-initrd
+          - rootfs-initrd-nvidia-gpu
+          - rootfs-initrd-nvidia-gpu-confidential
    steps:
      - name: Login to Kata Containers quay.io
        if: ${{ inputs.push-to-registry == 'yes' }}
@@ -327,6 +327,7 @@ jobs:
        with:
          ref: ${{ inputs.commit-hash }}
          fetch-depth: 0
+          fetch-tags: true
          persist-credentials: false
      - name: Rebase atop of the latest target branch
        run: |
@@ -342,6 +343,8 @@ jobs:
      - name: merge-artifacts
        run: |
          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
+        env:
+          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
      - name: store-artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
--- a/.github/workflows/build-kata-static-tarball-arm64.yaml
+++ b/.github/workflows/build-kata-static-tarball-arm64.yaml
@@ -145,7 +145,7 @@ jobs:
        asset:
          - rootfs-image
          - rootfs-initrd
-          - rootfs-nvidia-gpu-initrd
+          - rootfs-initrd-nvidia-gpu
    steps:
      - name: Login to Kata Containers quay.io
        if: ${{ inputs.push-to-registry == 'yes' }}
@@ -297,6 +297,7 @@ jobs:
        with:
          ref: ${{ inputs.commit-hash }}
          fetch-depth: 0
+          fetch-tags: true
          persist-credentials: false
      - name: Rebase atop of the latest target branch
        run: |
@@ -312,6 +313,8 @@ jobs:
      - name: merge-artifacts
        run: |
          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
+        env:
+          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
      - name: store-artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
--- a/.github/workflows/build-kata-static-tarball-ppc64le.yaml
+++ b/.github/workflows/build-kata-static-tarball-ppc64le.yaml
@@ -240,6 +240,7 @@ jobs:
        with:
          ref: ${{ inputs.commit-hash }}
          fetch-depth: 0
+          fetch-tags: true
          persist-credentials: false
      - name: Rebase atop of the latest target branch
        run: |
@@ -255,6 +256,8 @@ jobs:
      - name: merge-artifacts
        run: |
          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
+        env:
+          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
      - name: store-artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
--- a/.github/workflows/build-kata-static-tarball-s390x.yaml
+++ b/.github/workflows/build-kata-static-tarball-s390x.yaml
@@ -326,6 +326,7 @@ jobs:
        with:
          ref: ${{ inputs.commit-hash }}
          fetch-depth: 0
+          fetch-tags: true
          persist-credentials: false
      - name: Rebase atop of the latest target branch
        run: |
@@ -341,6 +342,8 @@ jobs:
      - name: merge-artifacts
        run: |
          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
+        env:
+          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
      - name: store-artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
--- a/.github/workflows/cleanup-resources.yaml
+++ b/.github/workflows/cleanup-resources.yaml
@@ -11,6 +11,7 @@ permissions:
 jobs:
  cleanup-resources:
    runs-on: ubuntu-22.04
+    environment: ci
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
--- a/.github/workflows/osv-scanner.yaml
+++ b/.github/workflows/osv-scanner.yaml
@@ -0,0 +1,41 @@
+# A sample workflow which sets up periodic OSV-Scanner scanning for vulnerabilities,
+# in addition to a PR check which fails if new vulnerabilities are introduced.
+#
+# For more examples and options, including how to ignore specific vulnerabilities,
+# see https://google.github.io/osv-scanner/github-action/
+
+name: OSV-Scanner
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '0 1 * * 0'
+  push:
+    branches: [ "main" ]
+
+jobs:
+  scan-scheduled:
+    permissions:
+      actions: read # # Required to upload SARIF file to CodeQL
+      contents: read  # Read commit contents
+      security-events: write  # Require writing security events to upload SARIF file to security tab
+    if: ${{ github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@b00f71e051ddddc6e46a193c31c8c0bf283bf9e6" # v2.1.0
+    with:
+      scan-args: |-
+        -r
+        ./
+  scan-pr:
+    permissions:
+      actions: read # Required to upload SARIF file to CodeQL
+      contents: read  # Read commit contents
+      security-events: write  # Require writing security events to upload SARIF file to security tab
+    if: ${{ github.event_name == 'pull_request' }}
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@b00f71e051ddddc6e46a193c31c8c0bf283bf9e6" # v2.1.0
+    with:
+      # Example of specifying custom arguments
+      scan-args: |-
+        -r
+        ./
--- a/.github/workflows/run-k8s-tests-on-aks.yaml
+++ b/.github/workflows/run-k8s-tests-on-aks.yaml
@@ -71,6 +71,7 @@ jobs:
            instance-type: normal
            auto-generate-policy: yes
    runs-on: ubuntu-22.04
+    environment: ci
    env:
      DOCKER_REGISTRY: ${{ inputs.registry }}
      DOCKER_REPO: ${{ inputs.repo }}
@@ -106,7 +107,9 @@ jobs:
        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-artifacts

      - name: Download Azure CLI
-        run: bash tests/integration/kubernetes/gha-run.sh install-azure-cli
+        uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4.0.1
+        with:
+          version: 'latest'

      - name: Log into the Azure account
        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
@@ -128,7 +131,9 @@ jobs:
        run: bash tests/integration/kubernetes/gha-run.sh install-bats

      - name: Install `kubectl`
-        run: bash tests/integration/kubernetes/gha-run.sh install-kubectl
+        uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4.0.1
+        with:
+          version: 'latest'

      - name: Download credentials for the Kubernetes CLI to use them
        run: bash tests/integration/kubernetes/gha-run.sh get-cluster-credentials
--- a/.github/workflows/run-k8s-tests-on-amd64.yaml
+++ b/.github/workflows/run-k8s-tests-on-amd64.yaml
@@ -79,6 +79,8 @@ jobs:

      - name: Deploy ${{ matrix.k8s }}
        run: bash tests/integration/kubernetes/gha-run.sh deploy-k8s
+        env:
+          CONTAINER_RUNTIME: ${{ matrix.container_runtime }}

      - name: Configure the ${{ matrix.snapshotter }} snapshotter
        if: matrix.snapshotter != ''
--- a/.github/workflows/run-kata-coco-stability-tests.yaml
+++ b/.github/workflows/run-kata-coco-stability-tests.yaml
@@ -52,6 +52,7 @@ jobs:
        pull-type:
          - guest-pull
    runs-on: ubuntu-22.04
+    environment: ci
    env:
      DOCKER_REGISTRY: ${{ inputs.registry }}
      DOCKER_REPO: ${{ inputs.repo }}
@@ -113,7 +114,9 @@ jobs:
        run: bash tests/integration/kubernetes/gha-run.sh install-bats

      - name: Install `kubectl`
-        run: bash tests/integration/kubernetes/gha-run.sh install-kubectl
+        uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4.0.1
+        with:
+          version: 'latest'

      - name: Download credentials for the Kubernetes CLI to use them
        run: bash tests/integration/kubernetes/gha-run.sh get-cluster-credentials
--- a/.github/workflows/run-kata-coco-tests.yaml
+++ b/.github/workflows/run-kata-coco-tests.yaml
@@ -126,7 +126,6 @@ jobs:
        timeout-minutes: 5
        run: bash tests/integration/kubernetes/gha-run.sh delete-csi-driver

-  # AMD has deprecated SEV support on Kata and henceforth SNP will be the only feature supported for Kata Containers.
  run-k8s-tests-sev-snp:
    strategy:
      fail-fast: false
@@ -224,6 +223,7 @@ jobs:
        pull-type:
          - guest-pull
    runs-on: ubuntu-22.04
+    environment: ci
    env:
      DOCKER_REGISTRY: ${{ inputs.registry }}
      DOCKER_REPO: ${{ inputs.repo }}
@@ -291,7 +291,9 @@ jobs:
        run: bash tests/integration/kubernetes/gha-run.sh install-bats

      - name: Install `kubectl`
-        run: bash tests/integration/kubernetes/gha-run.sh install-kubectl
+        uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4.0.1
+        with:
+          version: 'latest'

      - name: Download credentials for the Kubernetes CLI to use them
        run: bash tests/integration/kubernetes/gha-run.sh get-cluster-credentials
--- a/.github/workflows/run-kata-deploy-tests-on-aks.yaml
+++ b/.github/workflows/run-kata-deploy-tests-on-aks.yaml
@@ -49,6 +49,7 @@ jobs:
          - host_os: cbl-mariner
            vmm: clh
    runs-on: ubuntu-22.04
+    environment: ci
    env:
      DOCKER_REGISTRY: ${{ inputs.registry }}
      DOCKER_REPO: ${{ inputs.repo }}
@@ -94,7 +95,9 @@ jobs:
        run: bash tests/functional/kata-deploy/gha-run.sh install-bats

      - name: Install `kubectl`
-        run: bash tests/functional/kata-deploy/gha-run.sh install-kubectl
+        uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4.0.1
+        with:
+          version: 'latest'

      - name: Download credentials for the Kubernetes CLI to use them
        run: bash tests/functional/kata-deploy/gha-run.sh get-cluster-credentials
--- a/2
+++ b/2
@@ -1 +1 @@
-3.18.0
+3.19.1
--- a/src/agent/Cargo.lock
+++ b/src/agent/Cargo.lock
@@ -455,11 +455,11 @@ dependencies = [

 [[package]]
 name = "bit-set"
-version = "0.5.3"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0700ddab506f33b20a03b13996eccd309a48e5ff77d0d95926aa0210fb4e95f1"
+checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
 dependencies = [
- "bit-vec",
+ "bit-vec 0.8.0",
 ]

 [[package]]
@@ -468,6 +468,12 @@ version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "349f9b6a179ed607305526ca489b34ad0a41aed5f7980fa90eb03160b69598fb"

+[[package]]
+name = "bit-vec"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -524,6 +530,12 @@ dependencies = [
 "piper",
 ]

+[[package]]
+name = "borrow-or-share"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eeab4423108c5d7c744f4d234de88d18d636100093ae04caf4825134b9c3a32"
+
 [[package]]
 name = "borsh"
 version = "1.5.7"
@@ -647,7 +659,7 @@ dependencies = [
 [[package]]
 name = "cdi"
 version = "0.1.0"
-source = "git+https://github.com/cncf-tags/container-device-interface-rs?rev=fba5677a8e7cc962fc6e495fcec98d7d765e332a#fba5677a8e7cc962fc6e495fcec98d7d765e332a"
+source = "git+https://github.com/cncf-tags/container-device-interface-rs?rev=3b1e83dda5efcc83c7a4f134466ec006b37109c9#3b1e83dda5efcc83c7a4f134466ec006b37109c9"
 dependencies = [
 "anyhow",
 "clap",
@@ -946,6 +958,19 @@ dependencies = [
 "syn 2.0.101",
 ]

+[[package]]
+name = "dashmap"
+version = "5.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "978747c1d849a7d2ee5e8adc0159961c48fb7e5db2f06af6723b80123bb53856"
+dependencies = [
+ "cfg-if",
+ "hashbrown 0.14.5",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
 [[package]]
 name = "deranged"
 version = "0.4.0"
@@ -1062,6 +1087,15 @@ version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"

+[[package]]
+name = "email_address"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e079f19b08ca6239f47f8ba8509c11cf3ea30095831f7fed61441475edd8c449"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "enumflags2"
 version = "0.7.11"
@@ -1150,9 +1184,9 @@ dependencies = [

 [[package]]
 name = "fancy-regex"
-version = "0.13.0"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "531e46835a22af56d1e3b66f04844bed63158bc094a628bec1d321d9b4c44bf2"
+checksum = "6e24cb5a94bcae1e5408b0effca5cd7172ea3c5755049c5f3af4cd283a165298"
 dependencies = [
 "bit-set",
 "regex-automata 0.4.9",
@@ -1174,18 +1208,6 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"

-[[package]]
-name = "filetime"
-version = "0.2.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35c0522e981e68cbfa8c3f978441a5f34b30b96e146b33cd3359176b50fe8586"
-dependencies = [
- "cfg-if",
- "libc",
- "libredox",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "fixedbitset"
 version = "0.2.0"
@@ -1212,6 +1234,17 @@ dependencies = [
 "bitflags 1.3.2",
 ]

+[[package]]
+name = "fluent-uri"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1918b65d96df47d3591bed19c5cca17e3fa5d0707318e4b5ef2eae01764df7e5"
+dependencies = [
+ "borrow-or-share",
+ "ref-cast",
+ "serde",
+]
+
 [[package]]
 name = "fnv"
 version = "1.0.7"
@@ -1398,10 +1431,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
 dependencies = [
 "cfg-if",
- "js-sys",
 "libc",
 "wasi 0.11.0+wasi-snapshot-preview1",
- "wasm-bindgen",
 ]

 [[package]]
@@ -1461,6 +1492,12 @@ dependencies = [
 "ahash 0.7.8",
 ]

+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+
 [[package]]
 name = "hashbrown"
 version = "0.15.3"
@@ -1796,6 +1833,17 @@ dependencies = [
 "tokio",
 ]

+[[package]]
+name = "inotify"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f37dccff2791ab604f9babef0ba14fbe0be30bd368dc541e2b08d07c8aa908f3"
+dependencies = [
+ "bitflags 2.9.0",
+ "inotify-sys",
+ "libc",
+]
+
 [[package]]
 name = "inotify-sys"
 version = "0.1.5"
@@ -1825,6 +1873,17 @@ dependencies = [
 "windows-sys 0.48.0",
 ]

+[[package]]
+name = "io-uring"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b86e202f00093dcba4275d4636b93ef9dd75d025ae560d2521b45ea28ab49013"
+dependencies = [
+ "bitflags 2.9.0",
+ "cfg-if",
+ "libc",
+]
+
 [[package]]
 name = "iovec"
 version = "0.1.4"
@@ -1866,15 +1925,6 @@ version = "1.70.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"

-[[package]]
-name = "iso8601"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5c177cff824ab21a6f41079a4c401241c4e8be14f316c4c6b07d5fca351c98d"
-dependencies = [
- "nom 8.0.0",
-]
-
 [[package]]
 name = "itertools"
 version = "0.10.5"
@@ -1918,39 +1968,36 @@ version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c6e529149475ca0b2820835d3dce8fcc41c6b943ca608d32f35b449255e4627"
 dependencies = [
- "fluent-uri",
+ "fluent-uri 0.1.4",
 "serde",
 "serde_json",
 ]

 [[package]]
 name = "jsonschema"
-version = "0.18.3"
+version = "0.30.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa0f4bea31643be4c6a678e9aa4ae44f0db9e5609d5ca9dc9083d06eb3e9a27a"
+checksum = "f1b46a0365a611fbf1d2143104dcf910aada96fafd295bab16c60b802bf6fa1d"
 dependencies = [
 "ahash 0.8.12",
- "anyhow",
 "base64 0.22.1",
 "bytecount",
- "clap",
+ "email_address",
 "fancy-regex",
 "fraction",
- "getrandom 0.2.16",
- "iso8601",
+ "idna",
 "itoa",
- "memchr",
 "num-cmp",
+ "num-traits",
 "once_cell",
- "parking_lot 0.12.3",
 "percent-encoding",
+ "referencing",
 "regex",
+ "regex-syntax 0.8.5",
 "reqwest",
 "serde",
 "serde_json",
- "time",
- "url",
- "uuid",
+ "uuid-simd",
 ]

 [[package]]
@@ -1979,16 +2026,16 @@ dependencies = [
 "libc",
 "log",
 "logging",
- "mem-agent",
+ "mem-agent-lib",
 "netlink-packet-core",
 "netlink-packet-route",
 "netlink-sys 0.7.0",
- "nix 0.24.3",
+ "nix 0.26.4",
 "oci-spec",
 "opentelemetry",
 "procfs 0.12.0",
 "prometheus",
- "protobuf 3.7.2",
+ "protobuf",
 "protocols",
 "regex",
 "rstest",
@@ -2007,8 +2054,8 @@ dependencies = [
 "slog-scope",
 "slog-stdlog",
 "slog-term",
- "strum",
- "strum_macros",
+ "strum 0.26.3",
+ "strum_macros 0.26.4",
 "tempfile",
 "test-utils",
 "thiserror 1.0.69",
@@ -2052,7 +2099,7 @@ dependencies = [
 "lazy_static",
 "libc",
 "mockall",
- "nix 0.24.3",
+ "nix 0.26.4",
 "oci-spec",
 "once_cell",
 "pci-ids",
@@ -2143,7 +2190,6 @@ checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
 dependencies = [
 "bitflags 2.9.0",
 "libc",
- "redox_syscall 0.5.12",
 ]

 [[package]]
@@ -2232,6 +2278,12 @@ dependencies = [
 "slog-term",
 ]

+[[package]]
+name = "maplit"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d"
+
 [[package]]
 name = "matchers"
 version = "0.0.1"
@@ -2242,14 +2294,14 @@ dependencies = [
 ]

 [[package]]
-name = "mem-agent"
-version = "0.1.0"
+name = "mem-agent-lib"
+version = "0.2.0"
 dependencies = [
 "anyhow",
 "async-trait",
 "chrono",
- "lazy_static",
- "nix 0.23.2",
+ "maplit",
+ "nix 0.30.1",
 "page_size",
 "slog",
 "slog-scope",
@@ -2310,18 +2362,6 @@ dependencies = [
 "adler2",
 ]

-[[package]]
-name = "mio"
-version = "0.8.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
-dependencies = [
- "libc",
- "log",
- "wasi 0.11.0+wasi-snapshot-preview1",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "mio"
 version = "1.0.3"
@@ -2329,6 +2369,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
 dependencies = [
 "libc",
+ "log",
 "wasi 0.11.0+wasi-snapshot-preview1",
 "windows-sys 0.52.0",
 ]
@@ -2502,6 +2543,18 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "nix"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
+dependencies = [
+ "bitflags 2.9.0",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "nom"
 version = "7.1.3"
@@ -2512,34 +2565,30 @@ dependencies = [
 "minimal-lexical",
 ]

-[[package]]
-name = "nom"
-version = "8.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "notify"
-version = "6.1.1"
+version = "8.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6205bd8bb1e454ad2e27422015fb5e4f2bcc7e08fa8f27058670d208324a4d2d"
+checksum = "3163f59cd3fa0e9ef8c32f242966a7b9994fd7378366099593e0e73077cd8c97"
 dependencies = [
 "bitflags 2.9.0",
- "crossbeam-channel",
- "filetime",
 "fsevent-sys",
- "inotify",
+ "inotify 0.11.0",
 "kqueue",
 "libc",
 "log",
- "mio 0.8.11",
+ "mio",
+ "notify-types",
 "walkdir",
- "windows-sys 0.48.0",
+ "windows-sys 0.60.2",
 ]

+[[package]]
+name = "notify-types"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e0826a989adedc2a244799e823aece04662b66609d96af8dff7ac6df9a8925d"
+
 [[package]]
 name = "ntapi"
 version = "0.4.1"
@@ -2664,26 +2713,26 @@ dependencies = [

 [[package]]
 name = "oci-spec"
-version = "0.6.8"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f5a3fe998d50101ae009351fec56d88a69f4ed182e11000e711068c2f5abf72"
+checksum = "57e9beda9d92fac7bf4904c34c83340ef1024159faee67179a04e0277523da33"
 dependencies = [
+ "const_format",
 "derive_builder",
 "getset",
- "once_cell",
 "regex",
 "serde",
 "serde_json",
- "strum",
- "strum_macros",
- "thiserror 1.0.69",
+ "strum 0.27.1",
+ "strum_macros 0.27.1",
+ "thiserror 2.0.12",
 ]

 [[package]]
 name = "once_cell"
-version = "1.19.0"
+version = "1.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"

 [[package]]
 name = "opentelemetry"
@@ -2716,10 +2765,10 @@ dependencies = [
 ]

 [[package]]
-name = "os_str_bytes"
-version = "6.6.1"
+name = "outref"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2355d85b9a3786f481747ced0e0ff2ba35213a1f9bd406ed906554d7af805a1"
+checksum = "1a80800c0488c3a21695ea981a54918fbb37abf04f4d0720c453632255e2ff0e"

 [[package]]
 name = "page_size"
@@ -2737,17 +2786,6 @@ version = "2.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"

-[[package]]
-name = "parking_lot"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
-dependencies = [
- "instant",
- "lock_api",
- "parking_lot_core 0.8.6",
-]
-
 [[package]]
 name = "parking_lot"
 version = "0.12.3"
@@ -2755,21 +2793,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
 dependencies = [
 "lock_api",
- "parking_lot_core 0.9.10",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60a2cfe6f0ad2bfc16aefa463b497d5c7a5ecd44a23efa72aa342d90177356dc"
-dependencies = [
- "cfg-if",
- "instant",
- "libc",
- "redox_syscall 0.2.16",
- "smallvec",
- "winapi",
+ "parking_lot_core",
 ]

 [[package]]
@@ -2780,7 +2804,7 @@ checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
 dependencies = [
 "cfg-if",
 "libc",
- "redox_syscall 0.5.12",
+ "redox_syscall",
 "smallvec",
 "windows-targets 0.52.6",
 ]
@@ -2822,7 +2846,7 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d88ae3281b415d856e9c2ddbcdd5961e71c1a3e90138512c04d720241853a6af"
 dependencies = [
- "nom 7.1.3",
+ "nom",
 "phf",
 "phf_codegen",
 "proc-macro2",
@@ -3023,30 +3047,6 @@ dependencies = [
 "toml_edit 0.22.26",
 ]

-[[package]]
-name = "proc-macro-error"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
-dependencies = [
- "proc-macro-error-attr",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
- "version_check",
-]
-
-[[package]]
-name = "proc-macro-error-attr"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
-dependencies = [
- "proc-macro2",
- "quote",
- "version_check",
-]
-
 [[package]]
 name = "proc-macro-error-attr2"
 version = "2.0.0"
@@ -3095,22 +3095,21 @@ dependencies = [

 [[package]]
 name = "procfs"
-version = "0.16.0"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "731e0d9356b0c25f16f33b5be79b1c57b562f141ebfcdb0ad8ac2c13a24293b4"
+checksum = "cc5b72d8145275d844d4b5f6d4e1eef00c8cd889edb6035c21675d1bb1f45c9f"
 dependencies = [
 "bitflags 2.9.0",
 "hex",
- "lazy_static",
 "procfs-core",
 "rustix 0.38.44",
 ]

 [[package]]
 name = "procfs-core"
-version = "0.16.0"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d3554923a69f4ce04c4a754260c338f505ce22642d3830e049a399fc2059a29"
+checksum = "239df02d8349b06fc07398a3a1697b06418223b1c7725085e801e7c0fc6a12ec"
 dependencies = [
 "bitflags 2.9.0",
 "hex",
@@ -3118,19 +3117,19 @@ dependencies = [

 [[package]]
 name = "prometheus"
-version = "0.13.4"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d33c28a30771f7f96db69893f78b857f7450d7e0237e9c8fc6427a81bae7ed1"
+checksum = "3ca5326d8d0b950a9acd87e6a3f94745394f62e4dae1b1ee22b2bc0c394af43a"
 dependencies = [
 "cfg-if",
 "fnv",
 "lazy_static",
 "libc",
 "memchr",
- "parking_lot 0.12.3",
- "procfs 0.16.0",
- "protobuf 2.28.0",
- "thiserror 1.0.69",
+ "parking_lot",
+ "procfs 0.17.0",
+ "protobuf",
+ "thiserror 2.0.12",
 ]

 [[package]]
@@ -3184,12 +3183,6 @@ dependencies = [
 "prost",
 ]

-[[package]]
-name = "protobuf"
-version = "2.28.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "106dd99e98437432fed6519dedecfade6a06a73bb7b2a1e019fdd2bee5778d94"
-
 [[package]]
 name = "protobuf"
 version = "3.7.2"
@@ -3201,15 +3194,6 @@ dependencies = [
 "thiserror 1.0.69",
 ]

-[[package]]
-name = "protobuf-codegen"
-version = "2.28.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "033460afb75cf755fcfc16dfaed20b86468082a2ea24e05ac35ab4a099a017d6"
-dependencies = [
- "protobuf 2.28.0",
-]
-
 [[package]]
 name = "protobuf-codegen"
 version = "3.7.2"
@@ -3218,7 +3202,7 @@ checksum = "5d3976825c0014bbd2f3b34f0001876604fe87e0c86cd8fa54251530f1544ace"
 dependencies = [
 "anyhow",
 "once_cell",
- "protobuf 3.7.2",
+ "protobuf",
 "protobuf-parse",
 "regex",
 "tempfile",
@@ -3234,7 +3218,7 @@ dependencies = [
 "anyhow",
 "indexmap 2.9.0",
 "log",
- "protobuf 3.7.2",
+ "protobuf",
 "protobuf-support",
 "tempfile",
 "thiserror 1.0.69",
@@ -3256,7 +3240,7 @@ version = "0.1.0"
 dependencies = [
 "async-trait",
 "oci-spec",
- "protobuf 3.7.2",
+ "protobuf",
 "serde",
 "serde_json",
 "ttrpc",
@@ -3334,15 +3318,6 @@ dependencies = [
 "getrandom 0.2.16",
 ]

-[[package]]
-name = "redox_syscall"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
-dependencies = [
- "bitflags 1.3.2",
-]
-
 [[package]]
 name = "redox_syscall"
 version = "0.5.12"
@@ -3364,10 +3339,44 @@ dependencies = [
 ]

 [[package]]
-name = "regex"
-version = "1.10.6"
+name = "ref-cast"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4219d74c6b67a3654a9fbebc4b419e22126d13d2f3c4a07ee0cb61ff79a79619"
+checksum = "4a0ae411dbe946a674d89546582cea4ba2bb8defac896622d6496f14c23ba5cf"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1165225c21bff1f3bbce98f5a1f889949bc902d3575308cc7b0de30b4f6d27c7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.101",
+]
+
+[[package]]
+name = "referencing"
+version = "0.30.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8eff4fa778b5c2a57e85c5f2fe3a709c52f0e60d23146e2151cbef5893f420e"
+dependencies = [
+ "ahash 0.8.12",
+ "fluent-uri 0.3.2",
+ "once_cell",
+ "parking_lot",
+ "percent-encoding",
+ "serde_json",
+]
+
+[[package]]
+name = "regex"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
 dependencies = [
 "aho-corasick",
 "memchr",
@@ -3647,21 +3656,21 @@ dependencies = [
 "anyhow",
 "async-trait",
 "awaitgroup",
- "bit-vec",
+ "bit-vec 0.6.3",
 "capctl",
 "caps",
 "cfg-if",
 "cgroups-rs",
 "futures",
- "inotify",
+ "inotify 0.9.6",
 "kata-sys-util",
 "lazy_static",
 "libc",
 "libseccomp",
- "nix 0.24.3",
+ "nix 0.26.4",
 "oci-spec",
 "path-absolutize",
- "protobuf 3.7.2",
+ "protobuf",
 "protocols",
 "regex",
 "rlimit",
@@ -3871,20 +3880,23 @@ dependencies = [

 [[package]]
 name = "serial_test"
-version = "0.5.1"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0bccbcf40c8938196944a3da0e133e031a33f4d6b72db3bda3cc556e361905d"
+checksum = "1c789ec87f4687d022a2405cf46e0cd6284889f1839de292cadeb6c6019506f2"
 dependencies = [
+ "dashmap",
+ "futures",
 "lazy_static",
- "parking_lot 0.11.2",
+ "log",
+ "parking_lot",
 "serial_test_derive",
 ]

 [[package]]
 name = "serial_test_derive"
-version = "0.5.1"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2acd6defeddb41eb60bb468f8825d0cfd0c2a76bc03bfd235b6a1dc4f6a1ad5"
+checksum = "b64f9e531ce97c88b4778aad0ceee079216071cffec6ac9b904277f8f92e7fe3"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -4079,6 +4091,12 @@ version = "0.26.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8fec0f0aef304996cf250b31b5a10dee7980c85da9d759361292b8bca5a18f06"

+[[package]]
+name = "strum"
+version = "0.27.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f64def088c51c9510a8579e3c5d67c65349dcf755e5479ad3d010aa6454e2c32"
+
 [[package]]
 name = "strum_macros"
 version = "0.26.4"
@@ -4092,6 +4110,19 @@ dependencies = [
 "syn 2.0.101",
 ]

+[[package]]
+name = "strum_macros"
+version = "0.27.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c77a8c5abcaf0f9ce05d62342b7d298c346515365c36b673df4ebe3ced01fde8"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "rustversion",
+ "syn 2.0.101",
+]
+
 [[package]]
 name = "subprocess"
 version = "0.2.9"
@@ -4203,7 +4234,7 @@ checksum = "8f50febec83f5ee1df3015341d8bd429f2d1cc62bcba7ea2076759d315084683"
 name = "test-utils"
 version = "0.1.0"
 dependencies = [
- "nix 0.24.3",
+ "nix 0.26.4",
 ]

 [[package]]
@@ -4314,17 +4345,19 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"

 [[package]]
 name = "tokio"
-version = "1.45.0"
+version = "1.46.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2513ca694ef9ede0fb23fe71a4ee4107cb102b9dc1930f6d0fd77aae068ae165"
+checksum = "0cc3a2344dafbe23a245241fe8b09735b521110d30fcefbbd5feb1797ca35d17"
 dependencies = [
 "backtrace",
 "bytes 1.10.1",
+ "io-uring",
 "libc",
- "mio 1.0.3",
- "parking_lot 0.12.3",
+ "mio",
+ "parking_lot",
 "pin-project-lite",
 "signal-hook-registry",
+ "slab",
 "socket2 0.5.9",
 "tokio-macros",
 "windows-sys 0.52.0",
@@ -4550,8 +4583,8 @@ dependencies = [
 "libc",
 "log",
 "nix 0.26.4",
- "protobuf 3.7.2",
- "protobuf-codegen 3.7.2",
+ "protobuf",
+ "protobuf-codegen",
 "thiserror 1.0.69",
 "tokio",
 "tokio-vsock 0.4.0",
@@ -4560,30 +4593,28 @@ dependencies = [

 [[package]]
 name = "ttrpc-codegen"
-version = "0.5.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdc0529f65223eca94fc5830e7d552d0d152ff42b74aff5c641edac39592f41f"
+checksum = "0e5c657ef5cea6f6c6073c1be0787ba4482f42a569d4821e467daec795271f86"
 dependencies = [
- "home",
- "protobuf 2.28.0",
- "protobuf-codegen 3.7.2",
+ "protobuf",
+ "protobuf-codegen",
 "protobuf-support",
 "ttrpc-compiler",
 ]

 [[package]]
 name = "ttrpc-compiler"
-version = "0.7.0"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9be3fb2fe509cb9c0099b3b5551b759ae714f2dde56dfc713f2a5bda8c16064a"
+checksum = "3aa71f4a44711b3b9cc10ed0c7e239ff0fe4b8e6c900a142fb3bb26401385718"
 dependencies = [
 "derive-new",
- "home",
 "prost",
 "prost-build",
 "prost-types",
- "protobuf 2.28.0",
- "protobuf-codegen 2.28.0",
+ "protobuf",
+ "protobuf-codegen",
 "tempfile",
 ]

@@ -4669,6 +4700,17 @@ version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "458f7a779bf54acc9f347480ac654f68407d3aab21269a6e3c9f922acd9e2da9"

+[[package]]
+name = "uuid-simd"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b082222b4f6619906941c17eb2297fff4c2fb96cb60164170522942a200bd8"
+dependencies = [
+ "outref",
+ "uuid",
+ "vsimd",
+]
+
 [[package]]
 name = "valuable"
 version = "0.1.1"
@@ -4693,6 +4735,12 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"

+[[package]]
+name = "vsimd"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64"
+
 [[package]]
 name = "vsock"
 version = "0.2.6"
@@ -4985,7 +5033,7 @@ checksum = "4286ad90ddb45071efd1a66dfa43eb02dd0dfbae1545ad6cc3c51cf34d7e8ba3"
 dependencies = [
 "windows-result 0.3.2",
 "windows-strings 0.3.1",
- "windows-targets 0.53.0",
+ "windows-targets 0.53.2",
 ]

 [[package]]
@@ -5051,6 +5099,15 @@ dependencies = [
 "windows-targets 0.52.6",
 ]

+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.2",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.48.5"
@@ -5084,9 +5141,9 @@ dependencies = [

 [[package]]
 name = "windows-targets"
-version = "0.53.0"
+version = "0.53.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1e4c7e8ceaaf9cb7d7507c974735728ab453b67ef8f18febdd7c11fe59dca8b"
+checksum = "c66f69fcc9ce11da9966ddb31a40968cad001c5bedeb5c2b82ede4253ab48aef"
 dependencies = [
 "windows_aarch64_gnullvm 0.53.0",
 "windows_aarch64_msvc 0.53.0",
--- a/src/agent/Cargo.toml
+++ b/src/agent/Cargo.toml
@@ -8,18 +8,19 @@ license = "Apache-2.0"
 rust-version = "1.85.1"

 [workspace.dependencies]
-oci-spec = { version = "0.6.8", features = ["runtime"] }
+oci-spec = { version = "0.8.1", features = ["runtime"] }
 lazy_static = "1.3.0"
 ttrpc = { version = "0.8.4", features = ["async"], default-features = false }
 protobuf = "3.7.2"
 libc = "0.2.94"
-nix = "0.24.2"
+# Notes: nix needs to stay in sync with libs
+nix = "0.26.4"
 capctl = "0.2.0"
 scan_fmt = "0.2.6"
 scopeguard = "1.0.0"
 thiserror = "1.0.26"
 regex = "1.10.5"
-serial_test = "0.5.1"
+serial_test = "0.10.0"
 url = "2.5.0"
 derivative = "2.2.0"
 const_format = "0.2.30"
@@ -30,7 +31,7 @@ async-recursion = "0.3.2"
 futures = "0.3.30"

 # Async runtime
-tokio = { version = "1.44.2", features = ["full"] }
+tokio = { version = "1.46.1", features = ["full"] }
 tokio-vsock = "0.3.4"

 netlink-sys = { version = "0.7.0", features = ["tokio_socket"] }
@@ -49,7 +50,7 @@ slog-stdlog = "4.0.0"
 log = "0.4.11"

 cfg-if = "1.0.0"
-prometheus = { version = "0.13.0", features = ["process"] }
+prometheus = { version = "0.14.0", features = ["process"] }
 procfs = "0.12.0"

 anyhow = "1"
@@ -80,7 +81,7 @@ kata-agent-policy = { path = "policy" }
 rustjail = { path = "rustjail" }
 vsock-exporter = { path = "vsock-exporter" }

-mem-agent = { path = "../mem-agent" }
+mem-agent = { path = "../mem-agent", package = "mem-agent-lib" }

 kata-sys-util = { path = "../libs/kata-sys-util" }
 kata-types = { path = "../libs/kata-types" }
@@ -163,7 +164,7 @@ strum.workspace = true
 strum_macros.workspace = true

 # Agent Policy
-cdi = { git = "https://github.com/cncf-tags/container-device-interface-rs", rev = "fba5677a8e7cc962fc6e495fcec98d7d765e332a" }
+cdi = { git = "https://github.com/cncf-tags/container-device-interface-rs", rev = "3b1e83dda5efcc83c7a4f134466ec006b37109c9" }

 # Local dependencies
 kata-agent-policy = { workspace = true, optional = true }
--- a/src/agent/rustjail/src/container.rs
+++ b/src/agent/rustjail/src/container.rs
@@ -32,6 +32,7 @@ use crate::cgroups::{DevicesCgroupInfo, Manager};
 use crate::console;
 use crate::log_child;
 use crate::process::Process;
+use crate::process::ProcessOperations;
 #[cfg(feature = "seccomp")]
 use crate::seccomp;
 use crate::selinux;
@@ -261,7 +262,7 @@ pub struct LinuxContainer {
    pub init_process_start_time: u64,
    pub uid_map_path: String,
    pub gid_map_path: String,
-    pub processes: HashMap<pid_t, Process>,
+    pub processes: HashMap<String, Process>,
    pub status: ContainerStatus,
    pub created: SystemTime,
    pub logger: Logger,
@@ -933,17 +934,13 @@ impl BaseContainer for LinuxContainer {
    }

    fn processes(&self) -> Result<Vec<i32>> {
-        Ok(self.processes.keys().cloned().collect())
+        Ok(self.processes.values().map(|p| p.pid).collect())
    }

    fn get_process(&mut self, eid: &str) -> Result<&mut Process> {
-        for (_, v) in self.processes.iter_mut() {
-            if eid == v.exec_id.as_str() {
-                return Ok(v);
-            }
-        }
-
-        Err(anyhow!("invalid eid {}", eid))
+        self.processes
+            .get_mut(eid)
+            .ok_or_else(|| anyhow!("invalid eid {}", eid))
    }

    fn stats(&self) -> Result<StatsContainerResponse> {
@@ -967,6 +964,12 @@ impl BaseContainer for LinuxContainer {

    async fn start(&mut self, mut p: Process) -> Result<()> {
        let logger = self.logger.new(o!("eid" => p.exec_id.clone()));
+
+        // Check if exec_id is already in use to prevent collisions
+        if self.processes.contains_key(p.exec_id.as_str()) {
+            return Err(anyhow!("exec_id '{}' already exists", p.exec_id));
+        }
+
        let tty = p.tty;
        let fifo_file = format!("{}/{}", &self.root, EXEC_FIFO_FILENAME);
        info!(logger, "enter container.start!");
@@ -1235,7 +1238,7 @@ impl BaseContainer for LinuxContainer {
            let spec = self.config.spec.as_mut().unwrap();
            update_namespaces(&self.logger, spec, p.pid)?;
        }
-        self.processes.insert(p.pid, p);
+        self.processes.insert(p.exec_id.clone(), p);

        info!(logger, "wait on child log handler");
        let _ = log_handler
@@ -1261,13 +1264,13 @@ impl BaseContainer for LinuxContainer {
        let spec = self.config.spec.as_ref().unwrap();
        let st = self.oci_state()?;

-        for pid in self.processes.keys() {
-            match signal::kill(Pid::from_raw(*pid), Some(Signal::SIGKILL)) {
+        for process in self.processes.values() {
+            match signal::kill(process.pid(), Some(Signal::SIGKILL)) {
                Err(Errno::ESRCH) => {
                    info!(
                        self.logger,
                        "kill encounters ESRCH, pid: {}, container: {}",
-                        pid,
+                        process.pid(),
                        self.id.clone()
                    );
                    continue;
@@ -2081,13 +2084,14 @@ mod tests {
        });
    }

-    #[test]
-    fn test_linuxcontainer_get_process() {
+    #[tokio::test]
+    async fn test_linuxcontainer_get_process() {
        let _ = new_linux_container_and_then(|mut c: LinuxContainer| {
-            c.processes.insert(
-                1,
-                Process::new(&sl(), &oci::Process::default(), "123", true, 1, None).unwrap(),
-            );
+            let process =
+                Process::new(&sl(), &oci::Process::default(), "123", true, 1, None).unwrap();
+            let exec_id = process.exec_id.clone();
+            c.processes.insert(exec_id, process);
+
            let p = c.get_process("123");
            assert!(p.is_ok(), "Expecting Ok, Got {:?}", p);
            Ok(())
--- a/src/agent/rustjail/src/process.rs
+++ b/src/agent/rustjail/src/process.rs
@@ -179,6 +179,11 @@ impl Process {
                p.parent_stdin = Some(pstdin);
                p.stdin = Some(stdin);

+                // Make sure the parent stdin writer be inserted into
+                // p.writes hashmap, thus the cleanup_process_stream can
+                // cleanup and close the parent stdin fd.
+                let _ = p.get_writer(StreamType::ParentStdin);
+
                // These pipes are necessary as the stdout/stderr of the child process
                // cannot be a socket. Otherwise, some images relying on the /dev/stdout(stderr)
                // and /proc/self/fd/1(2) will fail to boot as opening an existing socket
@@ -308,8 +313,8 @@ mod tests {
        assert_eq!(max_size, actual_size);
    }

-    #[test]
-    fn test_process() {
+    #[tokio::test]
+    async fn test_process() {
        let id = "abc123rgb";
        let init = true;
        let process = Process::new(
--- a/src/agent/src/config.rs
+++ b/src/agent/src/config.rs
@@ -323,31 +323,31 @@ impl FromStr for AgentConfig {

            mem_agent_config_override!(
                agent_config_builder.mem_agent_memcg_disable,
-                mac.memcg_config.disabled
+                mac.memcg_config.default.disabled
            );
            mem_agent_config_override!(
                agent_config_builder.mem_agent_memcg_swap,
-                mac.memcg_config.swap
+                mac.memcg_config.default.swap
            );
            mem_agent_config_override!(
                agent_config_builder.mem_agent_memcg_swappiness_max,
-                mac.memcg_config.swappiness_max
+                mac.memcg_config.default.swappiness_max
            );
            mem_agent_config_override!(
                agent_config_builder.mem_agent_memcg_period_secs,
-                mac.memcg_config.period_secs
+                mac.memcg_config.default.period_secs
            );
            mem_agent_config_override!(
                agent_config_builder.mem_agent_memcg_period_psi_percent_limit,
-                mac.memcg_config.period_psi_percent_limit
+                mac.memcg_config.default.period_psi_percent_limit
            );
            mem_agent_config_override!(
                agent_config_builder.mem_agent_memcg_eviction_psi_percent_limit,
-                mac.memcg_config.eviction_psi_percent_limit
+                mac.memcg_config.default.eviction_psi_percent_limit
            );
            mem_agent_config_override!(
                agent_config_builder.mem_agent_memcg_eviction_run_aging_count_min,
-                mac.memcg_config.eviction_run_aging_count_min
+                mac.memcg_config.default.eviction_run_aging_count_min
            );

            mem_agent_config_override!(
@@ -549,43 +549,43 @@ impl AgentConfig {
                parse_cmdline_param!(
                    param,
                    MEM_AGENT_MEMCG_DISABLE,
-                    mac.memcg_config.disabled,
+                    mac.memcg_config.default.disabled,
                    get_number_value
                );
                parse_cmdline_param!(
                    param,
                    MEM_AGENT_MEMCG_SWAP,
-                    mac.memcg_config.swap,
+                    mac.memcg_config.default.swap,
                    get_number_value
                );
                parse_cmdline_param!(
                    param,
                    MEM_AGENT_MEMCG_SWAPPINESS_MAX,
-                    mac.memcg_config.swappiness_max,
+                    mac.memcg_config.default.swappiness_max,
                    get_number_value
                );
                parse_cmdline_param!(
                    param,
                    MEM_AGENT_MEMCG_PERIOD_SECS,
-                    mac.memcg_config.period_secs,
+                    mac.memcg_config.default.period_secs,
                    get_number_value
                );
                parse_cmdline_param!(
                    param,
                    MEM_AGENT_MEMCG_PERIOD_PSI_PERCENT_LIMIT,
-                    mac.memcg_config.period_psi_percent_limit,
+                    mac.memcg_config.default.period_psi_percent_limit,
                    get_number_value
                );
                parse_cmdline_param!(
                    param,
                    MEM_AGENT_MEMCG_EVICTION_PSI_PERCENT_LIMIT,
-                    mac.memcg_config.eviction_psi_percent_limit,
+                    mac.memcg_config.default.eviction_psi_percent_limit,
                    get_number_value
                );
                parse_cmdline_param!(
                    param,
                    MEM_AGENT_MEMCG_EVICTION_RUN_AGING_COUNT_MIN,
-                    mac.memcg_config.eviction_run_aging_count_min,
+                    mac.memcg_config.default.eviction_run_aging_count_min,
                    get_number_value
                );
                parse_cmdline_param!(
@@ -1408,7 +1408,10 @@ mod tests {
                contents: "agent.mem_agent_enable=1\nagent.mem_agent_memcg_period_secs=300",
                mem_agent: Some(MemAgentConfig {
                    memcg_config: mem_agent::memcg::Config {
-                        period_secs: 300,
+                        default: mem_agent::memcg::SingleConfig {
+                            period_secs: 300,
+                            ..Default::default()
+                        },
                        ..Default::default()
                    },
                    ..Default::default()
@@ -1419,7 +1422,10 @@ mod tests {
                contents: "agent.mem_agent_enable=1\nagent.mem_agent_memcg_period_secs=300\nagent.mem_agent_compact_order=6",
                mem_agent: Some(MemAgentConfig {
                    memcg_config: mem_agent::memcg::Config {
-                        period_secs: 300,
+                        default: mem_agent::memcg::SingleConfig {
+                            period_secs: 300,
+                            ..Default::default()
+                        },
                        ..Default::default()
                    },
                    compact_config: mem_agent::compact::Config {
--- a/src/agent/src/initdata.rs
+++ b/src/agent/src/initdata.rs
@@ -27,6 +27,9 @@ const AA_CONFIG_KEY: &str = "aa.toml";
 const CDH_CONFIG_KEY: &str = "cdh.toml";
 const POLICY_KEY: &str = "policy.rego";

+/// The path of initdata toml
+pub const INITDATA_TOML_PATH: &str = concatcp!(INITDATA_PATH, "/initdata.toml");
+
 /// The path of AA's config file
 pub const AA_CONFIG_PATH: &str = concatcp!(INITDATA_PATH, "/aa.toml");

@@ -95,7 +98,7 @@ pub async fn read_initdata(device_path: &str) -> Result<Vec<u8>> {
 }

 pub struct InitdataReturnValue {
-    pub digest: Vec<u8>,
+    pub _digest: Vec<u8>,
    pub _policy: Option<String>,
 }

@@ -122,7 +125,11 @@ pub async fn initialize_initdata(logger: &Logger) -> Result<Option<InitdataRetur
    info!(logger, "Initdata version: {}", initdata.version());
    initdata.validate()?;

-    let digest = match initdata.algorithm() {
+    tokio::fs::write(INITDATA_TOML_PATH, &initdata_content)
+        .await
+        .context("write initdata toml failed")?;
+
+    let _digest = match initdata.algorithm() {
        "sha256" => Sha256::digest(&initdata_content).to_vec(),
        "sha384" => Sha384::digest(&initdata_content).to_vec(),
        "sha512" => Sha512::digest(&initdata_content).to_vec(),
@@ -143,10 +150,10 @@ pub async fn initialize_initdata(logger: &Logger) -> Result<Option<InitdataRetur
        info!(logger, "write CDH config from initdata");
    }

-    debug!(logger, "Initdata digest: {}", STANDARD.encode(&digest));
+    debug!(logger, "Initdata digest: {}", STANDARD.encode(&_digest));

    let res = InitdataReturnValue {
-        digest,
+        _digest,
        _policy: initdata.get_coco_data(POLICY_KEY).cloned(),
    };

--- a/src/agent/src/main.rs
+++ b/src/agent/src/main.rs
@@ -19,7 +19,6 @@ extern crate scopeguard;
 extern crate slog;

 use anyhow::{anyhow, bail, Context, Result};
-use base64::Engine;
 use cfg_if::cfg_if;
 use clap::Parser;
 use const_format::concatcp;
@@ -485,12 +484,9 @@ async fn launch_guest_component_procs(

    debug!(logger, "spawning attestation-agent process {}", AA_PATH);
    let mut aa_args = vec!["--attestation_sock", AA_ATTESTATION_URI];
-    let initdata_parameter;
-    if let Some(initdata_return_value) = initdata_return_value {
-        initdata_parameter =
-            base64::engine::general_purpose::STANDARD.encode(&initdata_return_value.digest);
-        aa_args.push("--initdata");
-        aa_args.push(&initdata_parameter);
+    if initdata_return_value.is_some() {
+        aa_args.push("--initdata-toml");
+        aa_args.push(initdata::INITDATA_TOML_PATH);
    }

    launch_process(
--- a/src/agent/src/rpc.rs
+++ b/src/agent/src/rpc.rs
@@ -554,7 +554,7 @@ impl AgentService {
        req: protocols::agent::WaitProcessRequest,
    ) -> Result<protocols::agent::WaitProcessResponse> {
        let cid = req.container_id;
-        let eid = req.exec_id;
+        let mut eid = req.exec_id;
        let mut resp = WaitProcessResponse::new();

        info!(
@@ -587,7 +587,7 @@ impl AgentService {
            .get_container(&cid)
            .ok_or_else(|| anyhow!("Invalid container id"))?;

-        let p = match ctr.processes.get_mut(&pid) {
+        let p = match ctr.processes.values_mut().find(|p| p.pid == pid) {
            Some(p) => p,
            None => {
                // Lost race, pick up exit code from channel
@@ -600,6 +600,8 @@ impl AgentService {
            }
        };

+        eid = p.exec_id.clone();
+
        // need to close all fd
        // ignore errors for some fd might be closed by stream
        p.cleanup_process_stream();
@@ -611,7 +613,7 @@ impl AgentService {
            let _ = s.send(p.exit_code).await;
        }

-        ctr.processes.remove(&pid);
+        ctr.processes.remove(&eid);

        Ok(resp)
    }
@@ -708,13 +710,15 @@ fn mem_agent_memcgconfig_to_memcg_optionconfig(
    mc: &protocols::agent::MemAgentMemcgConfig,
 ) -> mem_agent::memcg::OptionConfig {
    mem_agent::memcg::OptionConfig {
-        disabled: mc.disabled,
-        swap: mc.swap,
-        swappiness_max: mc.swappiness_max.map(|x| x as u8),
-        period_secs: mc.period_secs,
-        period_psi_percent_limit: mc.period_psi_percent_limit.map(|x| x as u8),
-        eviction_psi_percent_limit: mc.eviction_psi_percent_limit.map(|x| x as u8),
-        eviction_run_aging_count_min: mc.eviction_run_aging_count_min,
+        default: mem_agent::memcg::SingleOptionConfig {
+            disabled: mc.disabled,
+            swap: mc.swap,
+            swappiness_max: mc.swappiness_max.map(|x| x as u8),
+            period_secs: mc.period_secs,
+            period_psi_percent_limit: mc.period_psi_percent_limit.map(|x| x as u8),
+            eviction_psi_percent_limit: mc.eviction_psi_percent_limit.map(|x| x as u8),
+            eviction_run_aging_count_min: mc.eviction_run_aging_count_min,
+        },
        ..Default::default()
    }
 }
@@ -2621,11 +2625,6 @@ mod tests {
                }),
                ..Default::default()
            },
-            TestData {
-                has_fd: false,
-                result: Err(anyhow!(ERR_CANNOT_GET_WRITER)),
-                ..Default::default()
-            },
        ];

        for (i, d) in tests.iter().enumerate() {
@@ -2673,7 +2672,7 @@ mod tests {
                }
                linux_container
                    .processes
-                    .insert(exec_process_id, exec_process);
+                    .insert(exec_process.exec_id.clone(), exec_process);

                sandbox.add_container(linux_container);
            }
--- a/src/agent/src/sandbox.rs
+++ b/src/agent/src/sandbox.rs
@@ -272,8 +272,10 @@ impl Sandbox {

    pub fn find_process(&mut self, pid: pid_t) -> Option<&mut Process> {
        for (_, c) in self.containers.iter_mut() {
-            if let Some(p) = c.processes.get_mut(&pid) {
-                return Some(p);
+            for p in c.processes.values_mut() {
+                if p.pid == pid {
+                    return Some(p);
+                }
            }
        }

@@ -286,9 +288,11 @@ impl Sandbox {
            .ok_or_else(|| anyhow!(ERR_INVALID_CONTAINER_ID))?;

        if eid.is_empty() {
+            let init_pid = ctr.init_process_pid;
            return ctr
                .processes
-                .get_mut(&ctr.init_process_pid)
+                .values_mut()
+                .find(|p| p.pid == init_pid)
                .ok_or_else(|| anyhow!("cannot find init process!"));
        }

@@ -1014,23 +1018,26 @@ mod tests {
        linux_container.init_process_pid = 1;
        linux_container.id = cid.to_string();
        // add init process
-        linux_container.processes.insert(
-            1,
-            Process::new(&logger, &oci::Process::default(), "1", true, 1, None).unwrap(),
-        );
+        let mut init_process =
+            Process::new(&logger, &oci::Process::default(), "1", true, 1, None).unwrap();
+        init_process.pid = 1;
+        linux_container
+            .processes
+            .insert("1".to_string(), init_process);
        // add exec process
-        linux_container.processes.insert(
-            123,
-            Process::new(
-                &logger,
-                &oci::Process::default(),
-                "exec-123",
-                false,
-                1,
-                None,
-            )
-            .unwrap(),
-        );
+        let mut exec_process = Process::new(
+            &logger,
+            &oci::Process::default(),
+            "exec-123",
+            false,
+            1,
+            None,
+        )
+        .unwrap();
+        exec_process.pid = 123;
+        linux_container
+            .processes
+            .insert("exec-123".to_string(), exec_process);

        s.add_container(linux_container);

@@ -1081,8 +1088,8 @@ mod tests {
            .unwrap();
            // processes interally only have pids when manually set
            test_process.pid = test_pid;
-
-            linux_container.processes.insert(test_pid, test_process);
+            let test_exec_id = test_process.exec_id.clone();
+            linux_container.processes.insert(test_exec_id, test_process);

            s.add_container(linux_container);

--- a/src/dragonball/Cargo.lock
+++ b/src/dragonball/Cargo.lock
@@ -56,17 +56,6 @@ version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"

-[[package]]
-name = "atty"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
-dependencies = [
- "hermit-abi 0.1.19",
- "libc",
- "winapi",
-]
-
 [[package]]
 name = "autocfg"
 version = "1.1.0"
@@ -154,7 +143,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "190baaad529bcfbde9e1a19022c42781bdb6ff9de25721abdb8fd98c0807730b"
 dependencies = [
 "libc",
- "thiserror",
+ "thiserror 1.0.48",
 ]

 [[package]]
@@ -277,7 +266,7 @@ dependencies = [
 "lazy_static",
 "libc",
 "nix 0.23.2",
- "thiserror",
+ "thiserror 1.0.48",
 "vm-memory",
 "vmm-sys-util",
 ]
@@ -286,7 +275,7 @@ dependencies = [
 name = "dbs-allocator"
 version = "0.1.1"
 dependencies = [
- "thiserror",
+ "thiserror 1.0.48",
 ]

 [[package]]
@@ -296,8 +285,8 @@ dependencies = [
 "kvm-bindings",
 "kvm-ioctls",
 "libc",
- "memoffset",
- "thiserror",
+ "memoffset 0.6.5",
+ "thiserror 1.0.48",
 "vm-memory",
 "vmm-sys-util",
 ]
@@ -313,7 +302,7 @@ dependencies = [
 "kvm-ioctls",
 "lazy_static",
 "libc",
- "thiserror",
+ "thiserror 1.0.48",
 "vm-fdt",
 "vm-memory",
 ]
@@ -322,7 +311,7 @@ dependencies = [
 name = "dbs-device"
 version = "0.2.0"
 dependencies = [
- "thiserror",
+ "thiserror 1.0.48",
 ]

 [[package]]
@@ -365,7 +354,7 @@ dependencies = [
 "kvm-ioctls",
 "libc",
 "log",
- "thiserror",
+ "thiserror 1.0.48",
 "vfio-bindings",
 "vfio-ioctls",
 "vm-memory",
@@ -377,7 +366,7 @@ version = "0.1.0"
 dependencies = [
 "kvm-bindings",
 "serde_json",
- "thiserror",
+ "thiserror 1.0.48",
 "vmm-sys-util",
 ]

@@ -389,7 +378,7 @@ dependencies = [
 "dbs-utils",
 "dbs-virtio-devices",
 "log",
- "thiserror",
+ "thiserror 1.0.48",
 "timerfd",
 ]

@@ -403,7 +392,7 @@ dependencies = [
 "log",
 "serde",
 "serde_json",
- "thiserror",
+ "thiserror 1.0.48",
 "timerfd",
 "vmm-sys-util",
 ]
@@ -434,7 +423,7 @@ dependencies = [
 "sendfd",
 "serde",
 "serde_json",
- "thiserror",
+ "thiserror 1.0.48",
 "threadpool",
 "timerfd",
 "vhost",
@@ -502,6 +491,17 @@ dependencies = [
 "winapi",
 ]

+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.104",
+]
+
 [[package]]
 name = "downcast-rs"
 version = "1.2.0"
@@ -547,7 +547,7 @@ dependencies = [
 "slog-scope",
 "slog-term",
 "test-utils",
- "thiserror",
+ "thiserror 1.0.48",
 "tracing",
 "vfio-bindings",
 "vfio-ioctls",
@@ -664,9 +664,9 @@ checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"

 [[package]]
 name = "form_urlencoded"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a62bc1cf6f830c2ec14a513a9fb124d0a213a629668a4186f329db21fe045652"
+checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456"
 dependencies = [
 "percent-encoding",
 ]
@@ -803,21 +803,18 @@ version = "0.15.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "84b26c544d002229e640969970a2e74021aadf6e2f96372b9c58eff97de08eb3"

-[[package]]
-name = "hermit-abi"
-version = "0.1.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "hermit-abi"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b"

+[[package]]
+name = "hermit-abi"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
+
 [[package]]
 name = "hex"
 version = "0.4.3"
@@ -928,13 +925,110 @@ dependencies = [
 ]

 [[package]]
-name = "idna"
-version = "0.4.0"
+name = "icu_collections"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d20d6b07bfbc108882d88ed8e37d39636dcc260e15e30c45e6ba089610b917c"
+checksum = "200072f5d0e3614556f94a9930d5dc3e0662a652823904c3a75dc3b0af7fee47"
 dependencies = [
- "unicode-bidi",
- "unicode-normalization",
+ "displaydoc",
+ "potential_utf",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cde2700ccaed3872079a65fb1a78f6c0a36c91570f28755dda67bc8f7d9f00a"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "436880e8e18df4d7bbc06d58432329d6458cc84531f7ac5f024e93deadb37979"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00210d6893afc98edb752b664b8890f0ef174c8adbb8d0be9710fa66fbbf72d3"
+
+[[package]]
+name = "icu_properties"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "016c619c1eeb94efb86809b015c58f479963de65bdb6253345c1a1276f22e32b"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "potential_utf",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "298459143998310acd25ffe6810ed544932242d3f07083eee1084d83a71bd632"
+
+[[package]]
+name = "icu_provider"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03c80da27b5f4187909049ee2d72f276f0d9f99a42c306bd0131ecfe04d8e5af"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "stable_deref_trait",
+ "tinystr",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "686f825264d630750a544639377bae737628043f20d38bbc029e8f29ea968a7e"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
 ]

 [[package]]
@@ -974,6 +1068,17 @@ version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28b29a3cd74f0f4598934efe3aeba42bae0eb4680554128851ebbecb02af14e6"

+[[package]]
+name = "is-terminal"
+version = "0.4.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e04d7f318608d35d4b61ddd75cbdaee86b023ebe2bd5a66ee0915f0bf93095a9"
+dependencies = [
+ "hermit-abi 0.5.2",
+ "libc",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "itoa"
 version = "1.0.9"
@@ -1053,12 +1158,6 @@ dependencies = [
 "vm-memory",
 ]

-[[package]]
-name = "linux-raw-sys"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f051f77a7c8e6957c0696eac88f26b0117e54f52d3fc682ab19397a8812846a4"
-
 [[package]]
 name = "linux-raw-sys"
 version = "0.3.8"
@@ -1071,6 +1170,12 @@ version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"

+[[package]]
+name = "litemap"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "241eaef5fd12c88705a01fc1066c48c4b36e0dd4377dcdc7ec3942cea7a69956"
+
 [[package]]
 name = "lock_api"
 version = "0.4.10"
@@ -1122,6 +1227,15 @@ dependencies = [
 "autocfg",
 ]

+[[package]]
+name = "memoffset"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
+dependencies = [
+ "autocfg",
+]
+
 [[package]]
 name = "mime"
 version = "0.3.17"
@@ -1188,7 +1302,7 @@ dependencies = [
 "cc",
 "cfg-if",
 "libc",
- "memoffset",
+ "memoffset 0.6.5",
 ]

 [[package]]
@@ -1200,7 +1314,20 @@ dependencies = [
 "bitflags 1.3.2",
 "cfg-if",
 "libc",
- "memoffset",
+ "memoffset 0.6.5",
+]
+
+[[package]]
+name = "nix"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "598beaf3cc6fdd9a5dfb1630c2800c7acd31df7aaf0f565796fba2b53ca1af1b"
+dependencies = [
+ "bitflags 1.3.2",
+ "cfg-if",
+ "libc",
+ "memoffset 0.7.1",
+ "pin-utils",
 ]

 [[package]]
@@ -1228,15 +1355,6 @@ dependencies = [
 "libc",
 ]

-[[package]]
-name = "num_threads"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2819ce041d2ee131036f4fc9d6ae7ae125a3a40e97ba64d04fe799ad9dabbb44"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "nydus-api"
 version = "0.3.1"
@@ -1364,7 +1482,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.32",
+ "syn 2.0.104",
 ]

 [[package]]
@@ -1420,9 +1538,9 @@ dependencies = [

 [[package]]
 name = "percent-encoding"
-version = "2.3.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
+checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"

 [[package]]
 name = "pin-project-lite"
@@ -1442,6 +1560,15 @@ version = "0.3.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"

+[[package]]
+name = "potential_utf"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5a7c30837279ca13e7c867e9e40053bc68740f988cb07f7ca6df43cc734b585"
+dependencies = [
+ "zerovec",
+]
+
 [[package]]
 name = "powerfmt"
 version = "0.2.0"
@@ -1450,9 +1577,9 @@ checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"

 [[package]]
 name = "proc-macro2"
-version = "1.0.66"
+version = "1.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18fb31db3f9bddb2ea821cde30a9f70117e3f119938b5ee630b7403aa6e2ead9"
+checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
 dependencies = [
 "unicode-ident",
 ]
@@ -1474,22 +1601,31 @@ dependencies = [

 [[package]]
 name = "procfs"
-version = "0.14.2"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1de8dacb0873f77e6aefc6d71e044761fcc68060290f5b1089fcdf84626bb69"
+checksum = "cc5b72d8145275d844d4b5f6d4e1eef00c8cd889edb6035c21675d1bb1f45c9f"
 dependencies = [
- "bitflags 1.3.2",
- "byteorder",
+ "bitflags 2.4.0",
+ "hex",
+ "procfs-core",
+ "rustix 0.38.25",
+]
+
+[[package]]
+name = "procfs-core"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "239df02d8349b06fc07398a3a1697b06418223b1c7725085e801e7c0fc6a12ec"
+dependencies = [
+ "bitflags 2.4.0",
 "hex",
- "lazy_static",
- "rustix 0.36.17",
 ]

 [[package]]
 name = "prometheus"
-version = "0.13.3"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "449811d15fbdf5ceb5c1144416066429cf82316e2ec8ce0c1f6f8a02e7bbcf8c"
+checksum = "3ca5326d8d0b950a9acd87e6a3f94745394f62e4dae1b1ee22b2bc0c394af43a"
 dependencies = [
 "cfg-if",
 "fnv",
@@ -1497,22 +1633,36 @@ dependencies = [
 "libc",
 "memchr",
 "parking_lot",
- "procfs 0.14.2",
+ "procfs 0.17.0",
 "protobuf",
- "thiserror",
+ "thiserror 2.0.12",
 ]

 [[package]]
 name = "protobuf"
-version = "2.28.0"
+version = "3.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "106dd99e98437432fed6519dedecfade6a06a73bb7b2a1e019fdd2bee5778d94"
+checksum = "d65a1d4ddae7d8b5de68153b48f6aa3bba8cb002b243dbdbc55a5afbc98f99f4"
+dependencies = [
+ "once_cell",
+ "protobuf-support",
+ "thiserror 1.0.48",
+]
+
+[[package]]
+name = "protobuf-support"
+version = "3.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e36c2f31e0a47f9280fb347ef5e461ffcd2c52dd520d8e216b52f93b0b0d7d6"
+dependencies = [
+ "thiserror 1.0.48",
+]

 [[package]]
 name = "quote"
-version = "1.0.33"
+version = "1.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
 dependencies = [
 "proc-macro2",
 ]
@@ -1549,7 +1699,7 @@ checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
 dependencies = [
 "getrandom 0.2.10",
 "redox_syscall 0.2.16",
- "thiserror",
+ "thiserror 1.0.48",
 ]

 [[package]]
@@ -1604,20 +1754,6 @@ version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"

-[[package]]
-name = "rustix"
-version = "0.36.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "305efbd14fde4139eb501df5f136994bb520b033fa9fbdce287507dc23b8c7ed"
-dependencies = [
- "bitflags 1.3.2",
- "errno",
- "io-lifetimes",
- "libc",
- "linux-raw-sys 0.1.4",
- "windows-sys 0.45.0",
-]
-
 [[package]]
 name = "rustix"
 version = "0.37.28"
@@ -1730,7 +1866,7 @@ checksum = "4eca7ac642d82aa35b60049a6eccb4be6be75e599bd2e9adb5f875a737654af2"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.32",
+ "syn 2.0.104",
 ]

 [[package]]
@@ -1824,11 +1960,11 @@ dependencies = [

 [[package]]
 name = "slog-term"
-version = "2.9.0"
+version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87d29185c55b7b258b4f120eab00f48557d4d9bc814f41713f449d35b0f8977c"
+checksum = "b6e022d0b998abfe5c3782c1f03551a596269450ccd677ea51c56f8b214610e8"
 dependencies = [
- "atty",
+ "is-terminal",
 "slog",
 "term",
 "thread_local",
@@ -1837,9 +1973,9 @@ dependencies = [

 [[package]]
 name = "smallvec"
-version = "1.11.0"
+version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62bb4feee49fdd9f707ef802e22365a35de4b7b299de4763d44bfea899442ff9"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"

 [[package]]
 name = "socket2"
@@ -1851,6 +1987,12 @@ dependencies = [
 "windows-sys 0.52.0",
 ]

+[[package]]
+name = "stable_deref_trait"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+
 [[package]]
 name = "subtle"
 version = "2.5.0"
@@ -1870,15 +2012,26 @@ dependencies = [

 [[package]]
 name = "syn"
-version = "2.0.32"
+version = "2.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "239814284fd6f1a4ffe4ca893952cdd93c224b6a1571c9a9eadd670295c0c9e2"
+checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40"
 dependencies = [
 "proc-macro2",
 "quote",
 "unicode-ident",
 ]

+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.104",
+]
+
 [[package]]
 name = "take_mut"
 version = "0.2.2"
@@ -1924,7 +2077,7 @@ dependencies = [
 name = "test-utils"
 version = "0.1.0"
 dependencies = [
- "nix 0.24.3",
+ "nix 0.26.4",
 ]

 [[package]]
@@ -1933,7 +2086,16 @@ version = "1.0.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d6d7a740b8a666a7e828dd00da9c0dc290dff53154ea77ac109281de90589b7"
 dependencies = [
- "thiserror-impl",
+ "thiserror-impl 1.0.48",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
+dependencies = [
+ "thiserror-impl 2.0.12",
 ]

 [[package]]
@@ -1944,7 +2106,18 @@ checksum = "49922ecae66cc8a249b77e68d1d0623c1b2c514f0060c27cdc68bd62a1219d35"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.32",
+ "syn 2.0.104",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.104",
 ]

 [[package]]
@@ -1974,9 +2147,7 @@ checksum = "35e7868883861bd0e56d9ac6efcaaca0d6d5d82a2a7ec8209ff492c07cf37b21"
 dependencies = [
 "deranged",
 "itoa",
- "libc",
 "num-conv",
- "num_threads",
 "powerfmt",
 "serde",
 "time-core",
@@ -2009,20 +2180,15 @@ dependencies = [
 ]

 [[package]]
-name = "tinyvec"
-version = "1.6.0"
+name = "tinystr"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
+checksum = "5d4f6d1145dcb577acf783d4e601bc1d76a13337bb54e6233add580b07344c8b"
 dependencies = [
- "tinyvec_macros",
+ "displaydoc",
+ "zerovec",
 ]

-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
 [[package]]
 name = "tokio"
 version = "1.44.2"
@@ -2047,7 +2213,7 @@ checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.32",
+ "syn 2.0.104",
 ]

 [[package]]
@@ -2108,7 +2274,7 @@ checksum = "1b1ffbcf9c6f6b99d386e7444eb608ba646ae452a36b39737deb9663b610f662"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.32",
+ "syn 2.0.104",
 ]

 [[package]]
@@ -2132,38 +2298,29 @@ version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"

-[[package]]
-name = "unicode-bidi"
-version = "0.3.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
-
 [[package]]
 name = "unicode-ident"
 version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "301abaae475aa91687eb82514b328ab47a211a533026cb25fc3e519b86adfc3c"

-[[package]]
-name = "unicode-normalization"
-version = "0.1.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
-dependencies = [
- "tinyvec",
-]
-
 [[package]]
 name = "url"
-version = "2.4.1"
+version = "2.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "143b538f18257fac9cad154828a57c6bf5157e1aa604d4816b5995bf6de87ae5"
+checksum = "32f8b686cadd1473f4bd0117a5d28d36b1ade384ea9b5069a1c40aefed7fda60"
 dependencies = [
 "form_urlencoded",
 "idna",
 "percent-encoding",
 ]

+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
 [[package]]
 name = "vcpkg"
 version = "0.2.15"
@@ -2193,7 +2350,7 @@ dependencies = [
 "kvm-ioctls",
 "libc",
 "log",
- "thiserror",
+ "thiserror 2.0.12",
 "vfio-bindings",
 "vm-memory",
 "vmm-sys-util",
@@ -2307,7 +2464,7 @@ dependencies = [
 "once_cell",
 "proc-macro2",
 "quote",
- "syn 2.0.32",
+ "syn 2.0.104",
 "wasm-bindgen-shared",
 ]

@@ -2341,7 +2498,7 @@ checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.32",
+ "syn 2.0.104",
 "wasm-bindgen-backend",
 "wasm-bindgen-shared",
 ]
@@ -2393,15 +2550,6 @@ dependencies = [
 "windows-targets 0.48.5",
 ]

-[[package]]
-name = "windows-sys"
-version = "0.45.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
-dependencies = [
- "windows-targets 0.42.2",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.48.0"
@@ -2420,21 +2568,6 @@ dependencies = [
 "windows-targets 0.52.6",
 ]

-[[package]]
-name = "windows-targets"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
-dependencies = [
- "windows_aarch64_gnullvm 0.42.2",
- "windows_aarch64_msvc 0.42.2",
- "windows_i686_gnu 0.42.2",
- "windows_i686_msvc 0.42.2",
- "windows_x86_64_gnu 0.42.2",
- "windows_x86_64_gnullvm 0.42.2",
- "windows_x86_64_msvc 0.42.2",
-]
-
 [[package]]
 name = "windows-targets"
 version = "0.48.5"
@@ -2466,12 +2599,6 @@ dependencies = [
 "windows_x86_64_msvc 0.52.6",
 ]

-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
-
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.48.5"
@@ -2484,12 +2611,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"

-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.48.5"
@@ -2502,12 +2623,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"

-[[package]]
-name = "windows_i686_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.48.5"
@@ -2526,12 +2641,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"

-[[package]]
-name = "windows_i686_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.48.5"
@@ -2544,12 +2653,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"

-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.48.5"
@@ -2562,12 +2665,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"

-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.48.5"
@@ -2580,12 +2677,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"

-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.48.5"
@@ -2617,6 +2708,12 @@ dependencies = [
 "bitflags 2.4.0",
 ]

+[[package]]
+name = "writeable"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea2f10b9bb0928dfb1b42b65e1f9e36f7f54dbdf08457afefb38afcdec4fa2bb"
+
 [[package]]
 name = "xattr"
 version = "1.0.1"
@@ -2626,6 +2723,84 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "yoke"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f41bb01b8226ef4bfd589436a297c53d118f65921786300e427be8d487695cc"
+dependencies = [
+ "serde",
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38da3c9736e16c5d3c8c597a9aaa5d1fa565d0532ae05e27c24aa62fb32c0ab6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.104",
+ "synstructure",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.104",
+ "synstructure",
+]
+
+[[package]]
+name = "zerotrie"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36f0bbd478583f79edad978b407914f61b2972f5af6fa089686016be8f9af595"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a05eb080e015ba39cc9e23bbe5e7fb04d5fb040350f99f34e338d5fdd294428"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b96237efa0c878c64bd89c436f661be4e46b2f3eff1ebb976f7ef2321d2f58f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.104",
+]
+
 [[package]]
 name = "zstd"
 version = "0.11.2+zstd.1.5.2"
--- a/src/dragonball/Cargo.toml
+++ b/src/dragonball/Cargo.toml
@@ -87,7 +87,7 @@ linux-loader = {workspace = true}
 log = "0.4.14"
 nix = "0.24.2"
 procfs = "0.12.0"
-prometheus = { version = "0.13.0", features = ["process"] }
+prometheus = { version = "0.14.0", features = ["process"] }
 seccompiler = {workspace = true}
 serde = "1.0.27"
 serde_derive = "1.0.27"
--- a/src/libs/.gitignore
+++ b/src/libs/.gitignore
@@ -0,0 +1 @@
+Cargo.lock
--- a/src/libs/Cargo.lock
+++ b/src/libs/Cargo.lock
--- a/src/libs/kata-sys-util/Cargo.toml
+++ b/src/libs/kata-sys-util/Cargo.toml
@@ -18,7 +18,7 @@ common-path = "=1.0.0"
 fail = "0.5.0"
 lazy_static = "1.4.0"
 libc = "0.2.100"
-nix = "0.24.2"
+nix = "0.26.4"
 once_cell = "1.9.0"
 serde = { version = "1.0.138", features = ["derive"] }
 serde_json = "1.0.73"
@@ -32,7 +32,7 @@ pci-ids = "0.2.5"
 mockall = "0.13.1"

 kata-types = { path = "../kata-types" }
-oci-spec = { version = "0.6.8", features = ["runtime"] }
+oci-spec = { version = "0.8.1", features = ["runtime"] }
 runtime-spec = { path = "../runtime-spec" }
 safe-path = { path = "../safe-path" }

--- a/src/libs/kata-types/Cargo.toml
+++ b/src/libs/kata-types/Cargo.toml
@@ -31,13 +31,13 @@ sha2 = "0.10.8"
 flate2 = { version = "1.0", features = ["zlib"] }
 hex = "0.4"

-oci-spec = { version = "0.6.8", features = ["runtime"] }
+oci-spec = { version = "0.8.1", features = ["runtime"] }
 safe-path = { path = "../safe-path" }

 [dev-dependencies]
 tempfile = "3.19.1"
 test-utils = { path = "../test-utils" }
-nix = "0.24.2"
+nix = "0.26.4"

 [features]
 default = []
--- a/src/libs/kata-types/src/mount.rs
+++ b/src/libs/kata-types/src/mount.rs
@@ -47,6 +47,9 @@ pub const SANDBOX_BIND_MOUNTS_RO: &str = ":ro";
 /// SANDBOX_BIND_MOUNTS_RO is for sandbox bindmounts with readwrite
 pub const SANDBOX_BIND_MOUNTS_RW: &str = ":rw";

+/// KATA_VIRTUAL_VOLUME_PREFIX is for container image guest pull
+pub const KATA_VIRTUAL_VOLUME_PREFIX: &str = "io.katacontainers.volume=";
+
 /// Directly assign a block volume to vm and mount it inside guest.
 pub const KATA_VIRTUAL_VOLUME_DIRECT_BLOCK: &str = "direct_block";
 /// Present a container image as a generic block device.
@@ -384,7 +387,15 @@ impl KataVirtualVolume {
    pub fn from_base64(value: &str) -> Result<Self> {
        let json = base64::decode(value)?;
        let volume: KataVirtualVolume = serde_json::from_slice(&json)?;
+
+        Ok(volume)
+    }
+
+    /// Decode and deserialize a virtual volume object from base64 encoded json string and validate it.
+    pub fn from_base64_and_validate(value: &str) -> Result<Self> {
+        let volume = Self::from_base64(value)?;
        volume.validate()?;
+
        Ok(volume)
    }
 }
@@ -532,7 +543,7 @@ pub fn adjust_rootfs_mounts() -> Result<Vec<Mount>> {
    // Create a new Vec<Mount> with a single Mount entry.
    // This Mount's options will contain the base64-encoded virtual volume.
    Ok(vec![Mount {
-        options: vec![format!("{}={}", "io.katacontainers.volume", b64_vol)],
+        options: vec![format!("{}{}", KATA_VIRTUAL_VOLUME_PREFIX, b64_vol)],
        ..Default::default() // Use default values for other Mount fields
    }])
 }
@@ -647,7 +658,8 @@ mod tests {
        volume.direct_volume = Some(DirectAssignedVolume { metadata });

        let value = volume.to_base64().unwrap();
-        let volume2: KataVirtualVolume = KataVirtualVolume::from_base64(value.as_str()).unwrap();
+        let volume2: KataVirtualVolume =
+            KataVirtualVolume::from_base64_and_validate(value.as_str()).unwrap();
        assert_eq!(volume.volume_type, volume2.volume_type);
        assert_eq!(volume.source, volume2.source);
        assert_eq!(volume.fs_type, volume2.fs_type);
--- a/src/libs/logging/Cargo.toml
+++ b/src/libs/logging/Cargo.toml
@@ -13,9 +13,13 @@ serde_json = "1.0.73"
 # - Dynamic keys required to allow HashMap keys to be slog::Serialized.
 # - The 'max_*' features allow changing the log level at runtime
 #   (by stopping the compiler from removing log calls).
-slog = { version = "2.5.2", features = ["dynamic-keys", "max_level_trace", "release_max_level_debug"] }
+slog = { version = "2.5.2", features = [
+    "dynamic-keys",
+    "max_level_trace",
+    "release_max_level_debug",
+] }
 slog-json = "2.4.0"
-slog-term = "2.9.0"
+slog-term = "2.9.1"
 slog-async = "2.7.0"
 slog-scope = "4.4.0"
 lazy_static = "1.3.0"
--- a/src/libs/protocols/Cargo.toml
+++ b/src/libs/protocols/Cargo.toml
@@ -16,8 +16,8 @@ async-trait = { version = "0.1.42", optional = true }
 protobuf = { version = "3.7.2" }
 serde = { version = "1.0.130", features = ["derive"] }
 serde_json = "1.0.68"
-oci-spec = { version = "0.6.8", features = ["runtime"] }
+oci-spec = { version = "0.8.1", features = ["runtime"] }

 [build-dependencies]
-ttrpc-codegen = "0.5.0"
+ttrpc-codegen = "0.6.0"
 protobuf = { version = "3.7.2" }
--- a/src/libs/shim-interface/Cargo.toml
+++ b/src/libs/shim-interface/Cargo.toml
@@ -13,7 +13,7 @@ edition = "2018"

 [dependencies]
 anyhow = "^1.0"
-nix = "0.24.0"
+nix = "0.26.4"
 tokio = { version = "1.44.2", features = ["rt-multi-thread"] }
 hyper = { version = "0.14.20", features = ["stream", "server", "http1"] }
 hyperlocal = "0.8"
--- a/src/libs/test-utils/Cargo.toml
+++ b/src/libs/test-utils/Cargo.toml
@@ -12,4 +12,4 @@ license = "Apache-2.0"
 edition = "2018"

 [dependencies]
-nix = "0.24.2"
+nix = "0.26.4"
--- a/src/mem-agent/.gitignore
+++ b/src/mem-agent/.gitignore
@@ -1,5 +0,0 @@
-/target
-/example/target
-/.vscode
-.vscode-ctags
-
--- a/src/mem-agent/Cargo.lock
+++ b/src/mem-agent/Cargo.lock
@@ -1,917 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "addr2line"
-version = "0.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a30b2e23b9e17a9f90641c7ab1549cd9b44f296d3ccbf309d2863cfe398a0cb"
-dependencies = [
- "gimli",
-]
-
-[[package]]
-name = "adler"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
-
-[[package]]
-name = "android-tzdata"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
-
-[[package]]
-name = "android_system_properties"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "anyhow"
-version = "1.0.81"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0952808a6c2afd1aa8947271f3a60f1a6763c7b912d210184c5149b5cf147247"
-
-[[package]]
-name = "arc-swap"
-version = "1.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b3d0060af21e8d11a926981cc00c6c1541aa91dd64b9f881985c3da1094425f"
-
-[[package]]
-name = "async-trait"
-version = "0.1.77"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c980ee35e870bd1a4d2c8294d4c04d0499e67bca1e4b5cefcc693c2fa00caea9"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "autocfg"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
-
-[[package]]
-name = "backtrace"
-version = "0.3.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2089b7e3f35b9dd2d0ed921ead4f6d318c27680d4a5bd167b3ee120edb105837"
-dependencies = [
- "addr2line",
- "cc",
- "cfg-if",
- "libc",
- "miniz_oxide",
- "object",
- "rustc-demangle",
-]
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "bitflags"
-version = "2.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
-
-[[package]]
-name = "bumpalo"
-version = "3.15.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ff69b9dd49fd426c69a0db9fc04dd934cdb6645ff000864d98f7e2af8830eaa"
-
-[[package]]
-name = "bytes"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
-
-[[package]]
-name = "cc"
-version = "1.0.90"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8cd6604a82acf3039f1144f54b8eb34e91ffba622051189e71b781822d5ee1f5"
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "chrono"
-version = "0.4.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8eaf5903dcbc0a39312feb77df2ff4c76387d591b9fc7b04a238dcf8bb62639a"
-dependencies = [
- "android-tzdata",
- "iana-time-zone",
- "js-sys",
- "num-traits",
- "wasm-bindgen",
- "windows-targets 0.52.4",
-]
-
-[[package]]
-name = "core-foundation-sys"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
-
-[[package]]
-name = "crossbeam-channel"
-version = "0.5.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
-
-[[package]]
-name = "deranged"
-version = "0.3.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
-dependencies = [
- "powerfmt",
-]
-
-[[package]]
-name = "dirs-next"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b98cf8ebf19c3d1b223e151f99a4f9f0690dca41414773390fc824184ac833e1"
-dependencies = [
- "cfg-if",
- "dirs-sys-next",
-]
-
-[[package]]
-name = "dirs-sys-next"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ebda144c4fe02d1f7ea1a7d9641b6fc6b580adcfa024ae48797ecdeb6825b4d"
-dependencies = [
- "libc",
- "redox_users",
- "winapi",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.2.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi",
-]
-
-[[package]]
-name = "gimli"
-version = "0.28.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
-
-[[package]]
-name = "hermit-abi"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbf6a919d6cf397374f7dfeeea91d974c7c0a7221d0d0f4f20d859d329e53fcc"
-
-[[package]]
-name = "iana-time-zone"
-version = "0.1.60"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7ffbb5a1b541ea2561f8c41c087286cc091e21e556a4f09a8f6cbf17b69b141"
-dependencies = [
- "android_system_properties",
- "core-foundation-sys",
- "iana-time-zone-haiku",
- "js-sys",
- "wasm-bindgen",
- "windows-core",
-]
-
-[[package]]
-name = "iana-time-zone-haiku"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "is-terminal"
-version = "0.4.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "261f68e344040fbd0edea105bef17c66edf46f984ddb1115b775ce31be948f4b"
-dependencies = [
- "hermit-abi",
- "libc",
- "windows-sys",
-]
-
-[[package]]
-name = "itoa"
-version = "1.0.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
-
-[[package]]
-name = "js-sys"
-version = "0.3.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29c15563dc2726973df627357ce0c9ddddbea194836909d655df6a75d2cf296d"
-dependencies = [
- "wasm-bindgen",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
-
-[[package]]
-name = "libc"
-version = "0.2.172"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
-
-[[package]]
-name = "libredox"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
-dependencies = [
- "bitflags 2.6.0",
- "libc",
-]
-
-[[package]]
-name = "lock_api"
-version = "0.4.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
-dependencies = [
- "autocfg",
- "scopeguard",
-]
-
-[[package]]
-name = "log"
-version = "0.4.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
-
-[[package]]
-name = "maplit"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d"
-
-[[package]]
-name = "mem-agent"
-version = "0.1.0"
-dependencies = [
- "anyhow",
- "async-trait",
- "chrono",
- "lazy_static",
- "maplit",
- "nix",
- "once_cell",
- "page_size",
- "slog",
- "slog-async",
- "slog-scope",
- "slog-term",
- "tokio",
-]
-
-[[package]]
-name = "memchr"
-version = "2.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
-
-[[package]]
-name = "memoffset"
-version = "0.6.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5aa361d4faea93603064a027415f07bd8e1d5c88c9fbf68bf56a285428fd79ce"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "miniz_oxide"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d811f3e15f28568be3407c8e7fdb6514c1cda3cb30683f15b6a1a1dc4ea14a7"
-dependencies = [
- "adler",
-]
-
-[[package]]
-name = "mio"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
-dependencies = [
- "libc",
- "wasi",
- "windows-sys",
-]
-
-[[package]]
-name = "nix"
-version = "0.23.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f3790c00a0150112de0f4cd161e3d7fc4b2d8a5542ffc35f099a2562aecb35c"
-dependencies = [
- "bitflags 1.3.2",
- "cc",
- "cfg-if",
- "libc",
- "memoffset",
-]
-
-[[package]]
-name = "num-conv"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
-
-[[package]]
-name = "num-traits"
-version = "0.2.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da0df0e5185db44f69b44f26786fe401b6c293d1907744beaa7fa62b2e5a517a"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "object"
-version = "0.32.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6a622008b6e321afc04970976f62ee297fdbaa6f95318ca343e3eebb9648441"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
-
-[[package]]
-name = "page_size"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30d5b2194ed13191c1999ae0704b7839fb18384fa22e49b57eeaa97d79ce40da"
-dependencies = [
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "parking_lot"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
-dependencies = [
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.9.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
-dependencies = [
- "cfg-if",
- "libc",
- "redox_syscall",
- "smallvec",
- "windows-targets 0.48.5",
-]
-
-[[package]]
-name = "pin-project-lite"
-version = "0.2.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
-
-[[package]]
-name = "powerfmt"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.79"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e835ff2298f5721608eb1a980ecaee1aef2c132bf95ecc026a11b7bf3c01c02e"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
-dependencies = [
- "bitflags 1.3.2",
-]
-
-[[package]]
-name = "redox_users"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
-dependencies = [
- "getrandom",
- "libredox",
- "thiserror",
-]
-
-[[package]]
-name = "rustc-demangle"
-version = "0.1.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
-
-[[package]]
-name = "rustversion"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e819f2bc632f285be6d7cd36e25940d45b2391dd6d9b939e79de557f7014248"
-
-[[package]]
-name = "scopeguard"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
-
-[[package]]
-name = "serde"
-version = "1.0.210"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8e3592472072e6e22e0a54d5904d9febf8508f65fb8552499a1abc7d1078c3a"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.210"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "243902eda00fad750862fc144cea25caca5e20d615af0a81bee94ca738f1df1f"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "signal-hook-registry"
-version = "1.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8229b473baa5980ac72ef434c4415e70c4b5e71b423043adb4ba059f89c99a1"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "slog"
-version = "2.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8347046d4ebd943127157b94d63abb990fcf729dc4e9978927fdf4ac3c998d06"
-
-[[package]]
-name = "slog-async"
-version = "2.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72c8038f898a2c79507940990f05386455b3a317d8f18d4caea7cbc3d5096b84"
-dependencies = [
- "crossbeam-channel",
- "slog",
- "take_mut",
- "thread_local",
-]
-
-[[package]]
-name = "slog-scope"
-version = "4.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f95a4b4c3274cd2869549da82b57ccc930859bdbf5bcea0424bc5f140b3c786"
-dependencies = [
- "arc-swap",
- "lazy_static",
- "slog",
-]
-
-[[package]]
-name = "slog-term"
-version = "2.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6e022d0b998abfe5c3782c1f03551a596269450ccd677ea51c56f8b214610e8"
-dependencies = [
- "is-terminal",
- "slog",
- "term",
- "thread_local",
- "time",
-]
-
-[[package]]
-name = "smallvec"
-version = "1.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6ecd384b10a64542d77071bd64bd7b231f4ed5940fba55e98c3de13824cf3d7"
-
-[[package]]
-name = "socket2"
-version = "0.5.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05ffd9c0a93b7543e062e759284fcf5f5e3b098501104bfbdde4d404db792871"
-dependencies = [
- "libc",
- "windows-sys",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.52"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b699d15b36d1f02c3e7c69f8ffef53de37aefae075d8488d4ba1a7788d574a07"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "take_mut"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f764005d11ee5f36500a149ace24e00e3da98b0158b3e2d53a7495660d3f4d60"
-
-[[package]]
-name = "term"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c59df8ac95d96ff9bede18eb7300b0fda5e5d8d90960e76f8e14ae765eedbf1f"
-dependencies = [
- "dirs-next",
- "rustversion",
- "winapi",
-]
-
-[[package]]
-name = "thiserror"
-version = "1.0.65"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d11abd9594d9b38965ef50805c5e469ca9cc6f197f883f717e0269a3057b3d5"
-dependencies = [
- "thiserror-impl",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.65"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae71770322cbd277e69d762a16c444af02aa0575ac0d174f0b9562d3b37f8602"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "thread_local"
-version = "1.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b9ef9bad013ada3808854ceac7b46812a6465ba368859a37e2100283d2d719c"
-dependencies = [
- "cfg-if",
- "once_cell",
-]
-
-[[package]]
-name = "time"
-version = "0.3.37"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35e7868883861bd0e56d9ac6efcaaca0d6d5d82a2a7ec8209ff492c07cf37b21"
-dependencies = [
- "deranged",
- "itoa",
- "num-conv",
- "powerfmt",
- "serde",
- "time-core",
- "time-macros",
-]
-
-[[package]]
-name = "time-core"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
-
-[[package]]
-name = "time-macros"
-version = "0.2.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2834e6017e3e5e4b9834939793b282bc03b37a3336245fa820e35e233e2a85de"
-dependencies = [
- "num-conv",
- "time-core",
-]
-
-[[package]]
-name = "tokio"
-version = "1.44.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6b88822cbe49de4185e3a4cbf8321dd487cf5fe0c5c65695fef6346371e9c48"
-dependencies = [
- "backtrace",
- "bytes",
- "libc",
- "mio",
- "parking_lot",
- "pin-project-lite",
- "signal-hook-registry",
- "socket2",
- "tokio-macros",
- "windows-sys",
-]
-
-[[package]]
-name = "tokio-macros"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
-
-[[package]]
-name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
-
-[[package]]
-name = "wasm-bindgen"
-version = "0.2.92"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
-dependencies = [
- "cfg-if",
- "wasm-bindgen-macro",
-]
-
-[[package]]
-name = "wasm-bindgen-backend"
-version = "0.2.92"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
-dependencies = [
- "bumpalo",
- "log",
- "once_cell",
- "proc-macro2",
- "quote",
- "syn",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-macro"
-version = "0.2.92"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
-dependencies = [
- "quote",
- "wasm-bindgen-macro-support",
-]
-
-[[package]]
-name = "wasm-bindgen-macro-support"
-version = "0.2.92"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "wasm-bindgen-backend",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-shared"
-version = "0.2.92"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
-
-[[package]]
-name = "windows-core"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
-dependencies = [
- "windows-targets 0.52.4",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
-dependencies = [
- "windows-targets 0.52.4",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
-dependencies = [
- "windows_aarch64_gnullvm 0.48.5",
- "windows_aarch64_msvc 0.48.5",
- "windows_i686_gnu 0.48.5",
- "windows_i686_msvc 0.48.5",
- "windows_x86_64_gnu 0.48.5",
- "windows_x86_64_gnullvm 0.48.5",
- "windows_x86_64_msvc 0.48.5",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.52.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dd37b7e5ab9018759f893a1952c9420d060016fc19a472b4bb20d1bdd694d1b"
-dependencies = [
- "windows_aarch64_gnullvm 0.52.4",
- "windows_aarch64_msvc 0.52.4",
- "windows_i686_gnu 0.52.4",
- "windows_i686_msvc 0.52.4",
- "windows_x86_64_gnu 0.52.4",
- "windows_x86_64_gnullvm 0.52.4",
- "windows_x86_64_msvc 0.52.4",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcf46cf4c365c6f2d1cc93ce535f2c8b244591df96ceee75d8e83deb70a9cac9"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da9f259dd3bcf6990b55bffd094c4f7235817ba4ceebde8e6d11cd0c5633b675"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.52.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b474d8268f99e0995f25b9f095bc7434632601028cf86590aea5c8a5cb7801d3"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1515e9a29e5bed743cb4415a9ecf5dfca648ce85ee42e15873c3cd8610ff8e02"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5eee091590e89cc02ad514ffe3ead9eb6b660aedca2183455434b93546371a03"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77ca79f2451b49fa9e2af39f0747fe999fcda4f5e241b2898624dca97a1f2177"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32b752e52a2da0ddfbdbcc6fceadfeede4c939ed16d13e648833a61dfb611ed8"
--- a/src/mem-agent/Cargo.toml
+++ b/src/mem-agent/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
-name = "mem-agent"
-version = "0.1.0"
-edition = "2018"
+name = "mem-agent-lib"
+version = "0.2.0"
+edition = "2021"

 [dependencies]
 slog = "2.5.2"
@@ -9,13 +9,14 @@ slog-scope = "4.1.2"
 anyhow = "1.0"
 page_size = "0.6"
 chrono = "0.4"
-tokio = { version = "1.44.2", features = ["full"] }
+tokio = { version = "1.45.1", features = ["full"] }
 async-trait = "0.1"
-lazy_static = "1.4"
-nix = "0.23.2"
+maplit = "1.0"
+nix = { version = "0.30.1", features = ["fs", "sched"] }

 [dev-dependencies]
 maplit = "1.0"
 slog-term = "2.9.0"
 slog-async = "2.7"
 once_cell = "1.9.0"
+lazy_static = "1.4"
--- a/src/mem-agent/Makefile
+++ b/src/mem-agent/Makefile
@@ -1,6 +0,0 @@
-# Copyright (C) 2024 Ant group. All rights reserved.
-#
-# SPDX-License-Identifier: Apache-2.0
-
-default:
-	cd example; cargo build --examples --target x86_64-unknown-linux-musl
--- a/src/mem-agent/example/Cargo.lock
+++ b/src/mem-agent/example/Cargo.lock
--- a/src/mem-agent/example/Cargo.toml
+++ b/src/mem-agent/example/Cargo.toml
@@ -1,36 +0,0 @@
-[package]
-name = "mem-agent-bin"
-version = "0.1.0"
-edition = "2018"
-
-[dependencies]
-slog = "2.5.2"
-slog-scope = "4.1.2"
-slog-term = "2.9.0"
-slog-async = "2.7"
-structopt = "0.3"
-anyhow = "1.0"
-libc = "0.2"
-page_size = "0.6"
-chrono = "0.4"
-maplit = "1.0"
-ttrpc = { version = "0.8", features = ["async"] }
-tokio = { version = "1.44.2", features = ["full"] }
-async-trait = "0.1"
-byteorder = "1.5"
-protobuf = "3.7.2"
-lazy_static = "1.4"
-# Rust 1.68 doesn't support 0.5.9
-home = "=0.5.5"
-mem-agent = { path = "../" }
-
-[[example]]
-name = "mem-agent-srv"
-path = "./srv.rs"
-
-[[example]]
-name = "mem-agent-ctl"
-path = "./ctl.rs"
-
-[build-dependencies]
-ttrpc-codegen = "0.4"
--- a/src/mem-agent/example/build.rs
+++ b/src/mem-agent/example/build.rs
@@ -1,29 +0,0 @@
-// Copyright (C) 2024 Ant group. All rights reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-
-use ttrpc_codegen::{Codegen, Customize, ProtobufCustomize};
-
-fn main() -> Result<(), Box<dyn std::error::Error>> {
-    let protos = vec![
-        "protocols/protos/mem-agent.proto",
-        "protocols/protos/google/protobuf/empty.proto",
-        "protocols/protos/google/protobuf/timestamp.proto",
-    ];
-
-    let protobuf_customized = ProtobufCustomize::default().gen_mod_rs(false);
-
-    Codegen::new()
-        .out_dir("protocols/")
-        .inputs(&protos)
-        .include("protocols/protos/")
-        .rust_protobuf()
-        .customize(Customize {
-            async_all: true,
-            ..Default::default()
-        })
-        .rust_protobuf_customize(protobuf_customized.clone())
-        .run()?;
-
-    Ok(())
-}
--- a/src/mem-agent/example/ctl.rs
+++ b/src/mem-agent/example/ctl.rs
@@ -1,79 +0,0 @@
-// Copyright (C) 2023 Ant group. All rights reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-
-mod protocols;
-mod share;
-
-use anyhow::{anyhow, Result};
-use protocols::empty;
-use protocols::mem_agent_ttrpc;
-use share::option::{CompactSetOption, MemcgSetOption};
-use structopt::StructOpt;
-use ttrpc::r#async::Client;
-
-#[derive(Debug, StructOpt)]
-enum Command {
-    #[structopt(name = "memcgstatus", about = "get memory cgroup status")]
-    MemcgStatus,
-
-    #[structopt(name = "memcgset", about = "set memory cgroup")]
-    MemcgSet(MemcgSetOption),
-
-    #[structopt(name = "compactset", about = "set compact")]
-    CompactSet(CompactSetOption),
-}
-
-#[derive(StructOpt, Debug)]
-#[structopt(name = "mem-agent-ctl", about = "Memory agent controler")]
-struct Opt {
-    #[structopt(long, default_value = "unix:///var/run/mem-agent.sock")]
-    addr: String,
-
-    #[structopt(subcommand)]
-    command: Command,
-}
-
-#[tokio::main]
-async fn main() -> Result<()> {
-    let opt = Opt::from_args();
-
-    // setup client
-    let c = Client::connect(&opt.addr).unwrap();
-    let client = mem_agent_ttrpc::ControlClient::new(c.clone());
-
-    match opt.command {
-        Command::MemcgStatus => {
-            let mss = client
-                .memcg_status(ttrpc::context::with_timeout(0), &empty::Empty::new())
-                .await
-                .map_err(|e| anyhow!("client.memcg_status fail: {}", e))?;
-            for mcg in mss.mem_cgroups {
-                println!("{:?}", mcg);
-                for (numa_id, n) in mcg.numa {
-                    if let Some(t) = n.last_inc_time.into_option() {
-                        println!("{} {:?}", numa_id, share::misc::timestamp_to_datetime(t)?);
-                    }
-                }
-            }
-        }
-
-        Command::MemcgSet(c) => {
-            let config = c.to_rpc_memcg_config();
-            client
-                .memcg_set(ttrpc::context::with_timeout(0), &config)
-                .await
-                .map_err(|e| anyhow!("client.memcg_status fail: {}", e))?;
-        }
-
-        Command::CompactSet(c) => {
-            let config = c.to_rpc_compact_config();
-            client
-                .compact_set(ttrpc::context::with_timeout(0), &config)
-                .await
-                .map_err(|e| anyhow!("client.memcg_status fail: {}", e))?;
-        }
-    }
-
-    Ok(())
-}
--- a/src/mem-agent/example/protocols/mod.rs
+++ b/src/mem-agent/example/protocols/mod.rs
@@ -1,8 +0,0 @@
-// Copyright (C) 2023 Ant group. All rights reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-
-pub mod empty;
-pub mod mem_agent;
-pub mod mem_agent_ttrpc;
-pub mod timestamp;
--- a/src/mem-agent/example/protocols/protos/google/protobuf/empty.proto
+++ b/src/mem-agent/example/protocols/protos/google/protobuf/empty.proto
@@ -1,52 +0,0 @@
-// Protocol Buffers - Google's data interchange format
-// Copyright 2008 Google Inc.  All rights reserved.
-// https://developers.google.com/protocol-buffers/
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//     * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived from
-// this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-syntax = "proto3";
-
-package google.protobuf;
-
-option csharp_namespace = "Google.Protobuf.WellKnownTypes";
-option go_package = "types";
-option java_package = "com.google.protobuf";
-option java_outer_classname = "EmptyProto";
-option java_multiple_files = true;
-option objc_class_prefix = "GPB";
-option cc_enable_arenas = true;
-
-// A generic empty message that you can re-use to avoid defining duplicated
-// empty messages in your APIs. A typical example is to use it as the request
-// or the response type of an API method. For instance:
-//
-//     service Foo {
-//       rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);
-//     }
-//
-// The JSON representation for `Empty` is empty JSON object `{}`.
-message Empty {}
--- a/src/mem-agent/example/protocols/protos/google/protobuf/timestamp.proto
+++ b/src/mem-agent/example/protocols/protos/google/protobuf/timestamp.proto
@@ -1,138 +0,0 @@
-// Protocol Buffers - Google's data interchange format
-// Copyright 2008 Google Inc.  All rights reserved.
-// https://developers.google.com/protocol-buffers/
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//     * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived from
-// this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-syntax = "proto3";
-
-package google.protobuf;
-
-option csharp_namespace = "Google.Protobuf.WellKnownTypes";
-option cc_enable_arenas = true;
-option go_package = "github.com/golang/protobuf/ptypes/timestamp";
-option java_package = "com.google.protobuf";
-option java_outer_classname = "TimestampProto";
-option java_multiple_files = true;
-option objc_class_prefix = "GPB";
-
-// A Timestamp represents a point in time independent of any time zone or local
-// calendar, encoded as a count of seconds and fractions of seconds at
-// nanosecond resolution. The count is relative to an epoch at UTC midnight on
-// January 1, 1970, in the proleptic Gregorian calendar which extends the
-// Gregorian calendar backwards to year one.
-//
-// All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap
-// second table is needed for interpretation, using a [24-hour linear
-// smear](https://developers.google.com/time/smear).
-//
-// The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By
-// restricting to that range, we ensure that we can convert to and from [RFC
-// 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings.
-//
-// # Examples
-//
-// Example 1: Compute Timestamp from POSIX `time()`.
-//
-//     Timestamp timestamp;
-//     timestamp.set_seconds(time(NULL));
-//     timestamp.set_nanos(0);
-//
-// Example 2: Compute Timestamp from POSIX `gettimeofday()`.
-//
-//     struct timeval tv;
-//     gettimeofday(&tv, NULL);
-//
-//     Timestamp timestamp;
-//     timestamp.set_seconds(tv.tv_sec);
-//     timestamp.set_nanos(tv.tv_usec * 1000);
-//
-// Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`.
-//
-//     FILETIME ft;
-//     GetSystemTimeAsFileTime(&ft);
-//     UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;
-//
-//     // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
-//     // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
-//     Timestamp timestamp;
-//     timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
-//     timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));
-//
-// Example 4: Compute Timestamp from Java `System.currentTimeMillis()`.
-//
-//     long millis = System.currentTimeMillis();
-//
-//     Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
-//         .setNanos((int) ((millis % 1000) * 1000000)).build();
-//
-//
-// Example 5: Compute Timestamp from current time in Python.
-//
-//     timestamp = Timestamp()
-//     timestamp.GetCurrentTime()
-//
-// # JSON Mapping
-//
-// In JSON format, the Timestamp type is encoded as a string in the
-// [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the
-// format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z"
-// where {year} is always expressed using four digits while {month}, {day},
-// {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional
-// seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution),
-// are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone
-// is required. A proto3 JSON serializer should always use UTC (as indicated by
-// "Z") when printing the Timestamp type and a proto3 JSON parser should be
-// able to accept both UTC and other timezones (as indicated by an offset).
-//
-// For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past
-// 01:30 UTC on January 15, 2017.
-//
-// In JavaScript, one can convert a Date object to this format using the
-// standard
-// [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString)
-// method. In Python, a standard `datetime.datetime` object can be converted
-// to this format using
-// [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with
-// the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use
-// the Joda Time's [`ISODateTimeFormat.dateTime()`](
-// http://www.joda.org/joda-time/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime%2D%2D
-// ) to obtain a formatter capable of generating timestamps in this format.
-//
-//
-message Timestamp {
-  // Represents seconds of UTC time since Unix epoch
-  // 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
-  // 9999-12-31T23:59:59Z inclusive.
-  int64 seconds = 1;
-
-  // Non-negative fractions of a second at nanosecond resolution. Negative
-  // second values with fractions must still have non-negative nanos values
-  // that count forward in time. Must be from 0 to 999,999,999
-  // inclusive.
-  int32 nanos = 2;
-}
--- a/src/mem-agent/example/protocols/protos/mem-agent.proto
+++ b/src/mem-agent/example/protocols/protos/mem-agent.proto
@@ -1,66 +0,0 @@
-// Copyright (C) 2023 Ant group. All rights reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-
-syntax = "proto3";
-
-package MemAgent;
-
-import "google/protobuf/empty.proto";
-import "google/protobuf/timestamp.proto";
-
-service Control {
-    rpc MemcgStatus(google.protobuf.Empty) returns (MemcgStatusReply);
-    rpc MemcgSet(MemcgConfig) returns (google.protobuf.Empty);
-    rpc CompactSet(CompactConfig) returns (google.protobuf.Empty);
-}
-
-message EvictionCount {
-    uint64 page = 1;
-    uint64 no_min_lru_file = 2;
-    uint64 min_lru_inc = 3;
-    uint64 other_error = 4;
-    uint64 error = 5;
-    uint64 psi_exceeds_limit = 6;
-}
-
-message StatusNuma {
-    google.protobuf.Timestamp last_inc_time = 1;
-    uint64 max_seq = 2;
-    uint64 min_seq = 3;
-    uint64 run_aging_count = 4;
-    EvictionCount eviction_count = 5;
-}
-
-message MemCgroup {
-    uint32 id = 1;
-    uint64 ino = 2;
-    string path = 3;
-    uint64 sleep_psi_exceeds_limit = 4;
-    map<uint32, StatusNuma> numa = 5;
-}
-
-message MemcgStatusReply {
-    repeated MemCgroup mem_cgroups = 1;
-}
-
-message MemcgConfig {
-    optional bool disabled = 1;
-    optional bool swap = 2;
-    optional uint32 swappiness_max = 3;
-    optional uint64 period_secs = 4;
-    optional uint32 period_psi_percent_limit = 5;
-    optional uint32 eviction_psi_percent_limit = 6;
-    optional uint64 eviction_run_aging_count_min = 7;
-}
-
-message CompactConfig {
-    optional bool disabled = 1;
-    optional uint64 period_secs = 2;
-    optional uint32 period_psi_percent_limit = 3;
-    optional uint32 compact_psi_percent_limit = 4;
-    optional int64 compact_sec_max = 5;
-    optional uint32 compact_order = 6;
-    optional uint64 compact_threshold = 7;
-    optional uint64 compact_force_times = 8;
-}
--- a/src/mem-agent/example/share/misc.rs
+++ b/src/mem-agent/example/share/misc.rs
@@ -1,29 +0,0 @@
-// Copyright (C) 2023 Ant group. All rights reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-
-use anyhow::{anyhow, Result};
-use chrono::{DateTime, LocalResult, TimeZone, Utc};
-use protobuf::well_known_types::timestamp::Timestamp;
-
-pub fn datatime_to_timestamp(dt: DateTime<Utc>) -> Timestamp {
-    let seconds = dt.timestamp();
-    let nanos = dt.timestamp_subsec_nanos();
-
-    Timestamp {
-        seconds,
-        nanos: nanos as i32,
-        ..Default::default()
-    }
-}
-
-#[allow(dead_code)]
-pub fn timestamp_to_datetime(timestamp: Timestamp) -> Result<DateTime<Utc>> {
-    let seconds = timestamp.seconds;
-    let nanos = timestamp.nanos;
-
-    match Utc.timestamp_opt(seconds, nanos as u32) {
-        LocalResult::Single(t) => Ok(t),
-        _ => Err(anyhow!("Utc.timestamp_opt {} fail", timestamp)),
-    }
-}
--- a/src/mem-agent/example/share/mod.rs
+++ b/src/mem-agent/example/share/mod.rs
@@ -1,7 +0,0 @@
-// Copyright (C) 2023 Ant group. All rights reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-
-pub mod misc;
-pub mod option;
-pub mod rpc;
--- a/src/mem-agent/example/share/option.rs
+++ b/src/mem-agent/example/share/option.rs
@@ -1,146 +0,0 @@
-// Copyright (C) 2024 Ant group. All rights reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::protocols::mem_agent as rpc;
-use structopt::StructOpt;
-
-#[derive(Debug, StructOpt)]
-pub struct MemcgSetOption {
-    #[structopt(long)]
-    memcg_disabled: Option<bool>,
-    #[structopt(long)]
-    memcg_swap: Option<bool>,
-    #[structopt(long)]
-    memcg_swappiness_max: Option<u8>,
-    #[structopt(long)]
-    memcg_period_secs: Option<u64>,
-    #[structopt(long)]
-    memcg_period_psi_percent_limit: Option<u8>,
-    #[structopt(long)]
-    memcg_eviction_psi_percent_limit: Option<u8>,
-    #[structopt(long)]
-    memcg_eviction_run_aging_count_min: Option<u64>,
-}
-
-impl MemcgSetOption {
-    #[allow(dead_code)]
-    pub fn to_rpc_memcg_config(&self) -> rpc::MemcgConfig {
-        let config = rpc::MemcgConfig {
-            disabled: self.memcg_disabled,
-            swap: self.memcg_swap,
-            swappiness_max: self.memcg_swappiness_max.map(|v| v as u32),
-            period_secs: self.memcg_period_secs,
-            period_psi_percent_limit: self.memcg_period_psi_percent_limit.map(|v| v as u32),
-            eviction_psi_percent_limit: self.memcg_eviction_psi_percent_limit.map(|v| v as u32),
-            eviction_run_aging_count_min: self.memcg_eviction_run_aging_count_min,
-            ..Default::default()
-        };
-
-        config
-    }
-
-    #[allow(dead_code)]
-    pub fn to_mem_agent_memcg_config(&self) -> mem_agent::memcg::Config {
-        let mut config = mem_agent::memcg::Config {
-            ..Default::default()
-        };
-
-        if let Some(v) = self.memcg_disabled {
-            config.disabled = v;
-        }
-        if let Some(v) = self.memcg_swap {
-            config.swap = v;
-        }
-        if let Some(v) = self.memcg_swappiness_max {
-            config.swappiness_max = v;
-        }
-        if let Some(v) = self.memcg_period_secs {
-            config.period_secs = v;
-        }
-        if let Some(v) = self.memcg_period_psi_percent_limit {
-            config.period_psi_percent_limit = v;
-        }
-        if let Some(v) = self.memcg_eviction_psi_percent_limit {
-            config.eviction_psi_percent_limit = v;
-        }
-        if let Some(v) = self.memcg_eviction_run_aging_count_min {
-            config.eviction_run_aging_count_min = v;
-        }
-
-        config
-    }
-}
-
-#[derive(Debug, StructOpt)]
-pub struct CompactSetOption {
-    #[structopt(long)]
-    compact_disabled: Option<bool>,
-    #[structopt(long)]
-    compact_period_secs: Option<u64>,
-    #[structopt(long)]
-    compact_period_psi_percent_limit: Option<u8>,
-    #[structopt(long)]
-    compact_psi_percent_limit: Option<u8>,
-    #[structopt(long)]
-    compact_sec_max: Option<i64>,
-    #[structopt(long)]
-    compact_order: Option<u8>,
-    #[structopt(long)]
-    compact_threshold: Option<u64>,
-    #[structopt(long)]
-    compact_force_times: Option<u64>,
-}
-
-impl CompactSetOption {
-    #[allow(dead_code)]
-    pub fn to_rpc_compact_config(&self) -> rpc::CompactConfig {
-        let config = rpc::CompactConfig {
-            disabled: self.compact_disabled,
-            period_secs: self.compact_period_secs,
-            period_psi_percent_limit: self.compact_period_psi_percent_limit.map(|v| v as u32),
-            compact_psi_percent_limit: self.compact_psi_percent_limit.map(|v| v as u32),
-            compact_sec_max: self.compact_sec_max,
-            compact_order: self.compact_order.map(|v| v as u32),
-            compact_threshold: self.compact_threshold,
-            compact_force_times: self.compact_force_times,
-            ..Default::default()
-        };
-
-        config
-    }
-
-    #[allow(dead_code)]
-    pub fn to_mem_agent_compact_config(&self) -> mem_agent::compact::Config {
-        let mut config = mem_agent::compact::Config {
-            ..Default::default()
-        };
-
-        if let Some(v) = self.compact_disabled {
-            config.disabled = v;
-        }
-        if let Some(v) = self.compact_period_secs {
-            config.period_secs = v;
-        }
-        if let Some(v) = self.compact_period_psi_percent_limit {
-            config.period_psi_percent_limit = v;
-        }
-        if let Some(v) = self.compact_psi_percent_limit {
-            config.compact_psi_percent_limit = v;
-        }
-        if let Some(v) = self.compact_sec_max {
-            config.compact_sec_max = v;
-        }
-        if let Some(v) = self.compact_order {
-            config.compact_order = v;
-        }
-        if let Some(v) = self.compact_threshold {
-            config.compact_threshold = v;
-        }
-        if let Some(v) = self.compact_force_times {
-            config.compact_force_times = v;
-        }
-
-        config
-    }
-}
--- a/src/mem-agent/example/share/rpc.rs
+++ b/src/mem-agent/example/share/rpc.rs
@@ -1,221 +0,0 @@
-// Copyright (C) 2023 Ant group. All rights reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::protocols::mem_agent as rpc_mem_agent;
-use crate::protocols::{empty, mem_agent_ttrpc};
-use anyhow::{anyhow, Result};
-use async_trait::async_trait;
-use mem_agent::{agent, compact, memcg};
-use slog_scope::{error, info};
-use std::fs;
-use std::os::unix::fs::PermissionsExt;
-use std::sync::Arc;
-use tokio::signal::unix::{signal, SignalKind};
-use ttrpc::asynchronous::Server;
-use ttrpc::error::Error;
-use ttrpc::proto::Code;
-
-#[derive(Debug)]
-pub struct MyControl {
-    agent: agent::MemAgent,
-}
-
-impl MyControl {
-    #[allow(dead_code)]
-    pub fn new(agent: agent::MemAgent) -> Self {
-        Self { agent }
-    }
-}
-
-fn mem_cgroup_to_mem_cgroup_rpc(mcg: &memcg::MemCgroup) -> rpc_mem_agent::MemCgroup {
-    rpc_mem_agent::MemCgroup {
-        id: mcg.id as u32,
-        ino: mcg.ino as u64,
-        path: mcg.path.clone(),
-        sleep_psi_exceeds_limit: mcg.sleep_psi_exceeds_limit,
-        numa: mcg
-            .numa
-            .iter()
-            .map(|(numa_id, n)| {
-                (
-                    *numa_id,
-                    rpc_mem_agent::StatusNuma {
-                        last_inc_time: protobuf::MessageField::some(
-                            crate::share::misc::datatime_to_timestamp(n.last_inc_time),
-                        ),
-                        max_seq: n.max_seq,
-                        min_seq: n.min_seq,
-                        run_aging_count: n.run_aging_count,
-                        eviction_count: protobuf::MessageField::some(
-                            rpc_mem_agent::EvictionCount {
-                                page: n.eviction_count.page,
-                                no_min_lru_file: n.eviction_count.no_min_lru_file,
-                                min_lru_inc: n.eviction_count.min_lru_inc,
-                                other_error: n.eviction_count.other_error,
-                                error: n.eviction_count.error,
-                                psi_exceeds_limit: n.eviction_count.psi_exceeds_limit,
-                                ..Default::default()
-                            },
-                        ),
-                        ..Default::default()
-                    },
-                )
-            })
-            .collect(),
-        ..Default::default()
-    }
-}
-
-fn mem_cgroups_to_memcg_status_reply(
-    mgs: Vec<memcg::MemCgroup>,
-) -> rpc_mem_agent::MemcgStatusReply {
-    let mem_cgroups: Vec<rpc_mem_agent::MemCgroup> = mgs
-        .iter()
-        .map(|x| mem_cgroup_to_mem_cgroup_rpc(&x))
-        .collect();
-
-    rpc_mem_agent::MemcgStatusReply {
-        mem_cgroups,
-        ..Default::default()
-    }
-}
-
-fn memcgconfig_to_memcg_optionconfig(mc: &rpc_mem_agent::MemcgConfig) -> memcg::OptionConfig {
-    let moc = memcg::OptionConfig {
-        disabled: mc.disabled,
-        swap: mc.swap,
-        swappiness_max: mc.swappiness_max.map(|val| val as u8),
-        period_secs: mc.period_secs,
-        period_psi_percent_limit: mc.period_psi_percent_limit.map(|val| val as u8),
-        eviction_psi_percent_limit: mc.eviction_psi_percent_limit.map(|val| val as u8),
-        eviction_run_aging_count_min: mc.eviction_run_aging_count_min,
-        ..Default::default()
-    };
-
-    moc
-}
-
-fn compactconfig_to_compact_optionconfig(
-    cc: &rpc_mem_agent::CompactConfig,
-) -> compact::OptionConfig {
-    let coc = compact::OptionConfig {
-        disabled: cc.disabled,
-        period_secs: cc.period_secs,
-        period_psi_percent_limit: cc.period_psi_percent_limit.map(|val| val as u8),
-        compact_psi_percent_limit: cc.compact_psi_percent_limit.map(|val| val as u8),
-        compact_sec_max: cc.compact_sec_max,
-        compact_order: cc.compact_order.map(|val| val as u8),
-        compact_threshold: cc.compact_threshold,
-        compact_force_times: cc.compact_force_times,
-        ..Default::default()
-    };
-
-    coc
-}
-
-#[async_trait]
-impl mem_agent_ttrpc::Control for MyControl {
-    async fn memcg_status(
-        &self,
-        _ctx: &::ttrpc::r#async::TtrpcContext,
-        _: empty::Empty,
-    ) -> ::ttrpc::Result<rpc_mem_agent::MemcgStatusReply> {
-        Ok(mem_cgroups_to_memcg_status_reply(
-            self.agent.memcg_status_async().await.map_err(|e| {
-                let estr = format!("agent.memcg_status_async fail: {}", e);
-                error!("{}", estr);
-                Error::RpcStatus(ttrpc::get_status(Code::INTERNAL, estr))
-            })?,
-        ))
-    }
-
-    async fn memcg_set(
-        &self,
-        _ctx: &::ttrpc::r#async::TtrpcContext,
-        mc: rpc_mem_agent::MemcgConfig,
-    ) -> ::ttrpc::Result<empty::Empty> {
-        self.agent
-            .memcg_set_config_async(memcgconfig_to_memcg_optionconfig(&mc))
-            .await
-            .map_err(|e| {
-                let estr = format!("agent.memcg_set_config_async fail: {}", e);
-                error!("{}", estr);
-                Error::RpcStatus(ttrpc::get_status(Code::INTERNAL, estr))
-            })?;
-        Ok(empty::Empty::new())
-    }
-
-    async fn compact_set(
-        &self,
-        _ctx: &::ttrpc::r#async::TtrpcContext,
-        cc: rpc_mem_agent::CompactConfig,
-    ) -> ::ttrpc::Result<empty::Empty> {
-        self.agent
-            .compact_set_config_async(compactconfig_to_compact_optionconfig(&cc))
-            .await
-            .map_err(|e| {
-                let estr = format!("agent.compact_set_config_async fail: {}", e);
-                error!("{}", estr);
-                Error::RpcStatus(ttrpc::get_status(Code::INTERNAL, estr))
-            })?;
-        Ok(empty::Empty::new())
-    }
-}
-
-#[allow(dead_code)]
-#[tokio::main]
-pub async fn rpc_loop(agent: agent::MemAgent, addr: String) -> Result<()> {
-    let path = addr
-        .strip_prefix("unix://")
-        .ok_or(anyhow!("format of addr {} is not right", addr))?;
-    if std::path::Path::new(path).exists() {
-        return Err(anyhow!("addr {} is exist", addr));
-    }
-
-    let control = MyControl::new(agent);
-    let c = Box::new(control) as Box<dyn mem_agent_ttrpc::Control + Send + Sync>;
-    let c = Arc::new(c);
-    let service = mem_agent_ttrpc::create_control(c);
-
-    let mut server = Server::new().bind(&addr).unwrap().register_service(service);
-
-    let metadata = fs::metadata(path).map_err(|e| anyhow!("fs::metadata {} fail: {}", path, e))?;
-    let mut permissions = metadata.permissions();
-    permissions.set_mode(0o600);
-    fs::set_permissions(path, permissions)
-        .map_err(|e| anyhow!("fs::set_permissions {} fail: {}", path, e))?;
-
-    let mut interrupt = signal(SignalKind::interrupt())
-        .map_err(|e| anyhow!("signal(SignalKind::interrupt()) fail: {}", e))?;
-    let mut quit = signal(SignalKind::quit())
-        .map_err(|e| anyhow!("signal(SignalKind::quit()) fail: {}", e))?;
-    let mut terminate = signal(SignalKind::terminate())
-        .map_err(|e| anyhow!("signal(SignalKind::terminate()) fail: {}", e))?;
-    server
-        .start()
-        .await
-        .map_err(|e| anyhow!("server.start() fail: {}", e))?;
-
-    tokio::select! {
-        _ = interrupt.recv() => {
-            info!("mem-agent: interrupt shutdown");
-        }
-
-        _ = quit.recv() => {
-            info!("mem-agent: quit shutdown");
-        }
-
-        _ = terminate.recv() => {
-            info!("mem-agent: terminate shutdown");
-        }
-    };
-
-    server
-        .shutdown()
-        .await
-        .map_err(|e| anyhow!("server.shutdown() fail: {}", e))?;
-    fs::remove_file(&path).map_err(|e| anyhow!("fs::remove_file {} fail: {}", path, e))?;
-
-    Ok(())
-}
--- a/src/mem-agent/example/srv.rs
+++ b/src/mem-agent/example/srv.rs
@@ -1,95 +0,0 @@
-// Copyright (C) 2023 Ant group. All rights reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-
-use anyhow::{anyhow, Result};
-use share::option::{CompactSetOption, MemcgSetOption};
-use slog::{Drain, Level, Logger};
-use slog_async;
-use slog_scope::set_global_logger;
-use slog_scope::{error, info};
-use slog_term;
-use std::fs::OpenOptions;
-use std::io::BufWriter;
-use structopt::StructOpt;
-
-mod protocols;
-mod share;
-
-#[derive(StructOpt, Debug)]
-#[structopt(name = "mem-agent", about = "Memory agent")]
-struct Opt {
-    #[structopt(long, default_value = "unix:///var/run/mem-agent.sock")]
-    addr: String,
-    #[structopt(long)]
-    log_file: Option<String>,
-    #[structopt(long, default_value = "trace", parse(try_from_str = parse_slog_level))]
-    log_level: Level,
-    #[structopt(flatten)]
-    memcg: MemcgSetOption,
-    #[structopt(flatten)]
-    compact: CompactSetOption,
-}
-
-fn parse_slog_level(src: &str) -> Result<Level, String> {
-    match src.to_lowercase().as_str() {
-        "trace" => Ok(Level::Trace),
-        "debug" => Ok(Level::Debug),
-        "info" => Ok(Level::Info),
-        "warning" => Ok(Level::Warning),
-        "warn" => Ok(Level::Warning),
-        "error" => Ok(Level::Error),
-        _ => Err(format!("Invalid log level: {}", src)),
-    }
-}
-
-fn setup_logging(opt: &Opt) -> Result<slog_scope::GlobalLoggerGuard> {
-    let drain = if let Some(f) = &opt.log_file {
-        let log_file = OpenOptions::new()
-            .create(true)
-            .write(true)
-            .append(true)
-            .open(f)
-            .map_err(|e| anyhow!("Open log file {} fail: {}", f, e))?;
-        let buffered = BufWriter::new(log_file);
-        let decorator = slog_term::PlainDecorator::new(buffered);
-        let drain = slog_term::CompactFormat::new(decorator)
-            .build()
-            .filter_level(opt.log_level)
-            .fuse();
-        slog_async::Async::new(drain).build().fuse()
-    } else {
-        let decorator = slog_term::TermDecorator::new().stderr().build();
-        let drain = slog_term::CompactFormat::new(decorator)
-            .build()
-            .filter_level(opt.log_level)
-            .fuse();
-        slog_async::Async::new(drain).build().fuse()
-    };
-
-    let logger = Logger::root(drain, slog::o!());
-    Ok(set_global_logger(logger.clone()))
-}
-
-fn main() -> Result<()> {
-    // Check opt
-    let opt = Opt::from_args();
-
-    let _ = setup_logging(&opt).map_err(|e| anyhow!("setup_logging fail: {}", e))?;
-
-    let memcg_config = opt.memcg.to_mem_agent_memcg_config();
-    let compact_config = opt.compact.to_mem_agent_compact_config();
-
-    let (ma, _rt) = mem_agent::agent::MemAgent::new(memcg_config, compact_config)
-        .map_err(|e| anyhow!("MemAgent::new fail: {}", e))?;
-
-    info!("MemAgent started");
-
-    share::rpc::rpc_loop(ma, opt.addr).map_err(|e| {
-        let estr = format!("rpc::rpc_loop fail: {}", e);
-        error!("{}", estr);
-        anyhow!("{}", estr)
-    })?;
-
-    Ok(())
-}
--- a/src/mem-agent/src/agent.rs
+++ b/src/mem-agent/src/agent.rs
@@ -4,8 +4,9 @@

 use crate::compact;
 use crate::memcg::{self, MemCgroup};
-use crate::{error, info};
+use crate::{debug, error, info};
 use anyhow::{anyhow, Result};
+use std::collections::HashMap;
 use std::thread;
 use tokio::runtime::{Builder, Runtime};
 use tokio::select;
@@ -27,7 +28,7 @@ enum AgentCmd {
 enum AgentReturn {
    Ok,
    Err(anyhow::Error),
-    MemcgStatus(Vec<memcg::MemCgroup>),
+    MemcgStatus(HashMap<String, memcg::MemCgroup>),
 }

 async fn handle_agent_cmd(
@@ -44,7 +45,16 @@ async fn handle_agent_cmd(
            ret_msg = AgentReturn::MemcgStatus(memcg.get_status().await);
            false
        }
-        AgentCmd::MemcgSet(opt) => memcg.set_config(opt).await,
+        AgentCmd::MemcgSet(opt) => match memcg.set_config(opt).await {
+            Ok(reset) => {
+                ret_msg = AgentReturn::Ok;
+                reset
+            }
+            Err(e) => {
+                ret_msg = AgentReturn::Err(e);
+                false
+            }
+        },
        AgentCmd::CompactSet(opt) => comp.set_config(opt).await,
    };

@@ -59,6 +69,11 @@ fn get_remaining_tokio_duration(memcg: &memcg::MemCG, comp: &compact::Compact) -
    let memcg_d = memcg.get_remaining_tokio_duration();
    let comp_d = comp.get_remaining_tokio_duration();

+    debug!(
+        "get_remaining_tokio_duration: memcg_d={:?}, comp_d={:?}",
+        memcg_d, comp_d
+    );
+
    if memcg_d > comp_d {
        comp_d
    } else {
@@ -76,6 +91,11 @@ async fn async_get_remaining_tokio_duration(
    let memcg_d = memcg_f.await;
    let comp_d = comp_f.await;

+    debug!(
+        "async_get_remaining_tokio_duration: memcg_d={:?}, comp_d={:?}",
+        memcg_d, comp_d
+    );
+
    if memcg_d > comp_d {
        comp_d
    } else {
@@ -84,16 +104,14 @@ async fn async_get_remaining_tokio_duration(
 }

 fn agent_work(mut memcg: memcg::MemCG, mut comp: compact::Compact) -> Result<Duration> {
-    let memcg_need_reset = if memcg.need_work() {
+    let memcg_work_list = memcg.get_timeout_list();
+    if memcg_work_list.len() > 0 {
        info!("memcg.work start");
        memcg
-            .work()
+            .work(&memcg_work_list)
            .map_err(|e| anyhow!("memcg.work failed: {}", e))?;
        info!("memcg.work stop");
-        true
-    } else {
-        false
-    };
+    }

    let compact_need_reset = if comp.need_work() {
        info!("compact.work start");
@@ -105,9 +123,8 @@ fn agent_work(mut memcg: memcg::MemCG, mut comp: compact::Compact) -> Result<Dur
        false
    };

-    if memcg_need_reset {
-        memcg.reset_timer();
-    }
+    memcg.reset_timers(&memcg_work_list);
+
    if compact_need_reset {
        comp.reset_timer();
    }
@@ -136,6 +153,8 @@ impl MemAgentSleep {
    }

    fn set_sleep(&mut self, d: Duration) {
+        info!("MemAgentSleep::set_sleep: {:?}", d);
+
        self.duration = d;
        self.start_wait_time = Instant::now();
    }
@@ -219,10 +238,17 @@ impl MemAgent {
        memcg_config: memcg::Config,
        compact_config: compact::Config,
    ) -> Result<(Self, Runtime)> {
-        let mg = memcg::MemCG::new(memcg_config)
+        let is_cg_v2 = crate::cgroup::is_cgroup_v2()?;
+        if is_cg_v2 {
+            info!("current host use cgroup v2");
+        } else {
+            info!("current host use cgroup v1");
+        }
+
+        let mg = memcg::MemCG::new(is_cg_v2, memcg_config)
            .map_err(|e| anyhow!("memcg::MemCG::new fail: {}", e))?;

-        let comp = compact::Compact::new(compact_config)
+        let comp = compact::Compact::new(is_cg_v2, compact_config)
            .map_err(|e| anyhow!("compact::Compact::new fail: {}", e))?;

        let (cmd_tx, cmd_rx) = mpsc::channel(10);
@@ -295,7 +321,7 @@ impl MemAgent {
        }
    }

-    pub async fn memcg_status_async(&self) -> Result<Vec<MemCgroup>> {
+    pub async fn memcg_status_async(&self) -> Result<HashMap<String, MemCgroup>> {
        let ret = self
            .send_cmd_async(AgentCmd::MemcgStatus)
            .await
@@ -323,10 +349,8 @@ mod tests {

    #[test]
    fn test_agent() {
-        let memcg_config = memcg::Config {
-            disabled: true,
-            ..Default::default()
-        };
+        let mut memcg_config = memcg::Config::default();
+        memcg_config.default.disabled = true;
        let compact_config = compact::Config {
            disabled: true,
            ..Default::default()
@@ -337,10 +361,8 @@ mod tests {
        tokio::runtime::Runtime::new()
            .unwrap()
            .block_on({
-                let memcg_config = memcg::OptionConfig {
-                    period_secs: Some(120),
-                    ..Default::default()
-                };
+                let mut memcg_config = memcg::OptionConfig::default();
+                memcg_config.default.period_secs = Some(120);
                ma.memcg_set_config_async(memcg_config)
            })
            .unwrap();
@@ -359,10 +381,8 @@ mod tests {

    #[test]
    fn test_agent_memcg_status() {
-        let memcg_config = memcg::Config {
-            disabled: true,
-            ..Default::default()
-        };
+        let mut memcg_config = memcg::Config::default();
+        memcg_config.default.disabled = true;
        let compact_config = compact::Config {
            disabled: true,
            ..Default::default()
--- a/src/mem-agent/src/cgroup.rs
+++ b/src/mem-agent/src/cgroup.rs
@@ -0,0 +1,23 @@
+// Copyright (C) 2025 Kylin Soft. All rights reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
+
+use anyhow::{anyhow, Result};
+use nix::sys::statfs::statfs;
+use std::path::Path;
+
+#[cfg(target_env = "musl")]
+const CGROUP2_SUPER_MAGIC: nix::sys::statfs::FsType = nix::sys::statfs::FsType(0x63677270);
+#[cfg(not(target_env = "musl"))]
+use nix::sys::statfs::CGROUP2_SUPER_MAGIC;
+
+pub const CGROUP_PATH: &str = "/sys/fs/cgroup/";
+pub const MEMCGS_V1_PATH: &str = "/sys/fs/cgroup/memory";
+
+pub fn is_cgroup_v2() -> Result<bool> {
+    let cgroup_path = Path::new("/sys/fs/cgroup");
+
+    let stat =
+        statfs(cgroup_path).map_err(|e| anyhow!("statfs {:?} failed: {}", cgroup_path, e))?;
+    Ok(stat.filesystem_type() == CGROUP2_SUPER_MAGIC)
+}
--- a/src/mem-agent/src/compact.rs
+++ b/src/mem-agent/src/compact.rs
@@ -2,6 +2,7 @@
 //
 // SPDX-License-Identifier: Apache-2.0

+use crate::cgroup::CGROUP_PATH;
 use crate::proc;
 use crate::psi;
 use crate::timer::Timeout;
@@ -59,7 +60,7 @@ impl Default for Config {
            period_secs: 10 * 60,
            period_psi_percent_limit: 1,
            compact_psi_percent_limit: 5,
-            compact_sec_max: 30 * 60,
+            compact_sec_max: 5 * 60,
            compact_order: PAGE_REPORTING_MIN_ORDER,
            compact_threshold: 2 << PAGE_REPORTING_MIN_ORDER,
            compact_force_times: std::u64::MAX,
@@ -238,7 +239,11 @@ pub struct Compact {
 }

 impl Compact {
-    pub fn new(mut config: Config) -> Result<Self> {
+    pub fn new(is_cg_v2: bool, mut config: Config) -> Result<Self> {
+        if is_cg_v2 {
+            config.psi_path = PathBuf::from(CGROUP_PATH);
+        }
+
        config.psi_path =
            psi::check(&config.psi_path).map_err(|e| anyhow!("psi::check failed: {}", e))?;

@@ -440,7 +445,8 @@ mod tests {

    #[test]
    fn test_compact() {
-        let mut c = Compact::new(Config::default()).unwrap();
+        let is_cg_v2 = crate::cgroup::is_cgroup_v2().unwrap();
+        let mut c = Compact::new(is_cg_v2, Config::default()).unwrap();
        assert!(c.work().is_ok());
    }
 }
--- a/src/mem-agent/src/lib.rs
+++ b/src/mem-agent/src/lib.rs
@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: Apache-2.0

 pub mod agent;
+mod cgroup;
 pub mod compact;
 pub mod memcg;
 mod mglru;
--- a/src/mem-agent/src/memcg.rs
+++ b/src/mem-agent/src/memcg.rs
--- a/src/mem-agent/src/mglru.rs
+++ b/src/mem-agent/src/mglru.rs
@@ -2,8 +2,9 @@
 //
 // SPDX-License-Identifier: Apache-2.0

-use crate::debug;
-use crate::warn;
+use crate::cgroup::CGROUP_PATH;
+use crate::cgroup::MEMCGS_V1_PATH;
+use crate::{debug, trace, warn};
 use anyhow::{anyhow, Result};
 use chrono::{DateTime, Duration, Utc};
 use std::collections::HashMap;
@@ -17,7 +18,7 @@ const WORKINGSET_ANON: usize = 0;
 const WORKINGSET_FILE: usize = 1;
 const LRU_GEN_ENABLED_PATH: &str = "/sys/kernel/mm/lru_gen/enabled";
 const LRU_GEN_PATH: &str = "/sys/kernel/debug/lru_gen";
-const MEMCGS_PATH: &str = "/sys/fs/cgroup/memory";
+pub const MAX_NR_GENS: u64 = 4;

 fn lru_gen_head_parse(line: &str) -> Result<(usize, String)> {
    let words: Vec<&str> = line.split_whitespace().map(|word| word.trim()).collect();
@@ -238,13 +239,18 @@ fn file_parse(
 pub fn host_memcgs_get(
    target_patchs: &HashSet<String>,
    parse_line: bool,
+    is_cg_v2: bool,
 ) -> Result<HashMap<String, (usize, usize, HashMap<usize, MGenLRU>)>> {
    let mgs = file_parse(target_patchs, parse_line)
        .map_err(|e| anyhow!("mglru file_parse failed: {}", e))?;

    let mut host_mgs = HashMap::new();
    for (path, (id, mglru)) in mgs {
-        let host_path = PathBuf::from(MEMCGS_PATH).join(path.trim_start_matches('/'));
+        let host_path = if is_cg_v2 {
+            PathBuf::from(CGROUP_PATH).join(path.trim_start_matches('/'))
+        } else {
+            PathBuf::from(MEMCGS_V1_PATH).join(path.trim_start_matches('/'))
+        };

        let metadata = match fs::metadata(host_path.clone()) {
            Err(e) => {
@@ -301,7 +307,7 @@ pub fn run_aging(
        "+ {} {} {} {} {}",
        memcg_id, numa_id, max_seq, can_swap as i32, force_scan as i32
    );
-    //trace!("send cmd {} to {}", cmd, LRU_GEN_PATH);
+    trace!("send cmd {} to {}", cmd, LRU_GEN_PATH);
    fs::write(LRU_GEN_PATH, &cmd)
        .map_err(|e| anyhow!("write file {} cmd {} failed: {}", LRU_GEN_PATH, cmd, e))?;
    Ok(())
@@ -318,7 +324,7 @@ pub fn run_eviction(
        "- {} {} {} {} {}",
        memcg_id, numa_id, min_seq, swappiness, nr_to_reclaim
    );
-    //trace!("send cmd {} to {}", cmd, LRU_GEN_PATH);
+    trace!("send cmd {} to {}", cmd, LRU_GEN_PATH);
    fs::write(LRU_GEN_PATH, &cmd)
        .map_err(|e| anyhow!("write file {} cmd {} failed: {}", LRU_GEN_PATH, cmd, e))?;
    Ok(())
--- a/src/mem-agent/src/misc.rs
+++ b/src/mem-agent/src/misc.rs
@@ -9,14 +9,14 @@ pub fn sl() -> slog::Logger {
 #[macro_export]
 macro_rules! error {
    ($($arg:tt)*) => {
-        slog::info!(crate::misc::sl(), "{}", format_args!($($arg)*))
+        slog::error!(crate::misc::sl(), "{}", format_args!($($arg)*))
    }
 }

 #[macro_export]
 macro_rules! warn {
    ($($arg:tt)*) => {
-        slog::info!(crate::misc::sl(), "{}", format_args!($($arg)*))
+        slog::warn!(crate::misc::sl(), "{}", format_args!($($arg)*))
    }
 }

@@ -30,14 +30,14 @@ macro_rules! info {
 #[macro_export]
 macro_rules! trace {
    ($($arg:tt)*) => {
-        slog::info!(crate::misc::sl(), "{}", format_args!($($arg)*))
+        slog::trace!(crate::misc::sl(), "{}", format_args!($($arg)*))
    }
 }

 #[macro_export]
 macro_rules! debug {
    ($($arg:tt)*) => {
-        slog::info!(crate::misc::sl(), "{}", format_args!($($arg)*))
+        slog::debug!(crate::misc::sl(), "{}", format_args!($($arg)*))
    }
 }

--- a/src/mem-agent/src/psi.rs
+++ b/src/mem-agent/src/psi.rs
@@ -2,6 +2,7 @@
 //
 // SPDX-License-Identifier: Apache-2.0

+use crate::cgroup::CGROUP_PATH;
 use crate::info;
 use anyhow::{anyhow, Result};
 use chrono::{DateTime, Utc};
@@ -11,7 +12,6 @@ use std::fs::OpenOptions;
 use std::io::{BufRead, BufReader};
 use std::path::PathBuf;

-const CGROUP_PATH: &str = "/sys/fs/cgroup/";
 const MEM_PSI: &str = "memory.pressure";
 const IO_PSI: &str = "io.pressure";

--- a/src/runtime-rs/Cargo.lock
+++ b/src/runtime-rs/Cargo.lock
--- a/src/runtime-rs/Cargo.toml
+++ b/src/runtime-rs/Cargo.toml
@@ -49,8 +49,8 @@ dbs-utils = { path = "../dragonball/dbs_utils" }
 actix-rt = "2.7.0"
 anyhow = "1.0"
 async-trait = "0.1.48"
-containerd-shim = { version = "0.6.0", features = ["async"] }
-containerd-shim-protos = { version = "0.6.0", features = ["async"] }
+containerd-shim = { version = "0.10.0", features = ["async"] }
+containerd-shim-protos = { version = "0.10.0", features = ["async"] }
 go-flag = "0.1.0"
 hyper = "0.14.20"
 hyperlocal = "0.8.0"
@@ -58,8 +58,9 @@ lazy_static = "1.4"
 libc = "0.2"
 log = "0.4.14"
 netns-rs = "0.1.0"
-nix = "0.24.2"
-oci-spec = { version = "0.6.8", features = ["runtime"] }
+# Note: nix needs to stay sync'd with libs versions
+nix = "0.26.4"
+oci-spec = { version = "0.8.1", features = ["runtime"] }
 protobuf = "3.7.2"
 rand = "0.8.4"
 serde = { version = "1.0.145", features = ["derive"] }
@@ -69,8 +70,8 @@ slog-scope = "4.4.0"
 strum = { version = "0.24.0", features = ["derive"] }
 tempfile = "3.19.1"
 thiserror = "1.0"
-tokio = "1.38.2"
+tokio = "1.46.1"
 tracing = "0.1.41"
 tracing-opentelemetry = "0.18.0"
 ttrpc = "0.8.4"
-url = "2.3.1"
+url = "2.5.4"
--- a/src/runtime-rs/Makefile
+++ b/src/runtime-rs/Makefile
@@ -311,13 +311,15 @@ ifneq (,$(QEMUCMD))
    DEFSANDBOXCGROUPONLY_QEMU := false
 ifeq ($(ARCH), s390x)
    VMROOTFSDRIVER_QEMU := virtio-blk-ccw
+    DEFBLOCKSTORAGEDRIVER_QEMU := virtio-blk-ccw
 else
    VMROOTFSDRIVER_QEMU := virtio-pmem
+    DEFBLOCKSTORAGEDRIVER_QEMU := virtio-blk-pci
 endif
    DEFVCPUS_QEMU := 1
    DEFMAXVCPUS_QEMU := 0
    DEFSHAREDFS_QEMU_VIRTIOFS := virtio-fs
-    DEFBLOCKSTORAGEDRIVER_QEMU := virtio-scsi
+    DEFSHAREDFS_QEMU_SEL_VIRTIOFS := none
    DEFBLOCKDEVICEAIO_QEMU := io_uring
    DEFNETWORKMODEL_QEMU := tcfilter
    DEFDISABLEGUESTSELINUX := true
@@ -472,6 +474,7 @@ USER_VARS += DEFBLOCKDEVICEAIO_QEMU
 USER_VARS += DEFBLOCKSTORAGEDRIVER_FC
 USER_VARS += DEFSHAREDFS_CLH_VIRTIOFS
 USER_VARS += DEFSHAREDFS_QEMU_VIRTIOFS
+USER_VARS += DEFSHAREDFS_QEMU_SEL_VIRTIOFS
 USER_VARS += DEFVIRTIOFSDAEMON
 USER_VARS += DEFVALIDVIRTIOFSDAEMONPATHS
 USER_VARS += DEFVIRTIOFSCACHESIZE
--- a/src/runtime-rs/config/configuration-cloud-hypervisor.toml.in
+++ b/src/runtime-rs/config/configuration-cloud-hypervisor.toml.in
@@ -168,8 +168,9 @@ default_bridges = @DEFBRIDGES@
 # Default false
 #reclaim_guest_freed_memory = true

-# Block storage driver to be used for the hypervisor in case the container
-# rootfs is backed by a block device.
+# Block device driver to be used by the hypervisor when a container's storage
+# is backed by a block device or a file. This driver facilitates attaching the
+# storage directly to the guest VM.
 block_device_driver = "virtio-blk-pci"

 # Specifies cache-related options for block devices.
--- a/src/runtime-rs/config/configuration-dragonball.toml.in
+++ b/src/runtime-rs/config/configuration-dragonball.toml.in
@@ -118,9 +118,11 @@ default_memory = @DEFMEMSZ@
 # > amount of physical RAM      --> will be set to the actual amount of physical RAM
 default_maxmemory = @DEFMAXMEMSZ@

-
-# Block storage driver to be used for the hypervisor in case the container
-# rootfs is backed by a block device. DB only supports virtio-blk.
+# Block device driver to be used by the hypervisor when a container's storage
+# is backed by a block device or a file. This driver facilitates attaching the
+# storage directly to the guest VM.
+#
+# DB only supports virtio-blk-mmio.
 block_device_driver = "@DEFBLOCKSTORAGEDRIVER_DB@"

 # This option changes the default hypervisor and kernel parameters
--- a/src/runtime-rs/config/configuration-qemu-runtime-rs.toml.in
+++ b/src/runtime-rs/config/configuration-qemu-runtime-rs.toml.in
@@ -235,9 +235,15 @@ virtio_fs_extra_args = @DEFVIRTIOFSEXTRAARGS@
 #    Metadata, data, and pathname lookup are cached in guest and never expire.
 virtio_fs_cache = "@DEFVIRTIOFSCACHE@"

-# Block storage driver to be used for the hypervisor in case the container
-# rootfs is backed by a block device. This is virtio-scsi, virtio-blk
-# or nvdimm.
+# Block device driver to be used by the hypervisor when a container's
+# storage is backed by a block device or a file. This driver facilitates attaching
+# the storage directly to the guest VM.
+#
+# Examples include:
+# - virtio-blk-pci
+# - virtio-blk-ccw
+# - virtio-scsi
+# - nvidmm
 block_device_driver = "@DEFBLOCKSTORAGEDRIVER_QEMU@"

 # aio is the I/O mechanism used by qemu
--- a/src/runtime-rs/config/configuration-qemu-se-runtime-rs.toml.in
+++ b/src/runtime-rs/config/configuration-qemu-se-runtime-rs.toml.in
@@ -170,7 +170,7 @@ disable_block_device_use = @DEFDISABLEBLOCK@
 #   - virtio-9p
 #   - virtio-fs-nydus
 #   - none
-shared_fs = "@DEFSHAREDFS_QEMU_VIRTIOFS@"
+shared_fs = "@DEFSHAREDFS_QEMU_SEL_VIRTIOFS@"

 # Path to vhost-user-fs daemon.
 virtio_fs_daemon = "@DEFVIRTIOFSDAEMON@"
@@ -211,9 +211,15 @@ virtio_fs_extra_args = @DEFVIRTIOFSEXTRAARGS@
 #    Metadata, data, and pathname lookup are cached in guest and never expire.
 virtio_fs_cache = "@DEFVIRTIOFSCACHE@"

-# Block storage driver to be used for the hypervisor in case the container
-# rootfs is backed by a block device. This is virtio-scsi, virtio-blk
-# or nvdimm.
+# Block device driver to be used by the hypervisor when a container's storage
+# is backed by a block device or a file. This driver facilitates attaching the
+# storage directly to the guest VM.
+#
+# Examples include:
+# - virtio-blk-pci
+# - virtio-blk-ccw
+# - virtio-scsi
+# - nvidmm
 block_device_driver = "@DEFBLOCKSTORAGEDRIVER_QEMU@"

 # aio is the I/O mechanism used by qemu
--- a/src/runtime-rs/config/configuration-rs-fc.toml.in
+++ b/src/runtime-rs/config/configuration-rs-fc.toml.in
@@ -112,9 +112,11 @@ memory_slots = @DEFMEMSLOTS@
 # > amount of physical RAM      --> will be set to the actual amount of physical RAM
 default_maxmemory = @DEFMAXMEMSZ_FC@

-# Block storage driver to be used for the hypervisor in case the container
-# rootfs is backed by a block device. This is virtio-scsi, virtio-blk
-# or nvdimm.
+# Block device driver to be used by the hypervisor when a container's storage
+# is backed by a block device or a file. This driver facilitates attaching the
+# storage directly to the guest VM.
+#
+# FC only supports virtio-blk-mmio.
 block_device_driver = "@DEFBLOCKSTORAGEDRIVER_FC@"

 # Specifies cache-related options will be set to block devices or not.
--- a/src/runtime-rs/crates/agent/src/sock/vsock.rs
+++ b/src/runtime-rs/crates/agent/src/sock/vsock.rs
@@ -55,6 +55,15 @@ impl Sock for Vsock {
            connect(socket.as_raw_fd(), &sock_addr)
                .with_context(|| format!("failed to connect to {}", sock_addr))?;

+            // Started from tokio v1.44.0+, it would panic when giving
+            // `from_std()` a blocking socket. A workaround is to set the
+            // socket to non-blocking, see [1].
+            //
+            // https://github.com/tokio-rs/tokio/issues/7172
+            socket
+                .set_nonblocking(true)
+                .context("failed to set non-blocking")?;
+
            // Finally, convert the std UnixSocket to tokio's UnixSocket.
            UnixStream::from_std(socket).context("from_std")
        };
--- a/src/runtime-rs/crates/hypervisor/Cargo.toml
+++ b/src/runtime-rs/crates/hypervisor/Cargo.toml
@@ -33,7 +33,6 @@ oci-spec = { workspace = true }
 futures = "0.3.25"
 safe-path = "0.1.0"
 crossbeam-channel = "0.5.6"
-tempdir = "0.3.7"
 qapi = { version = "0.14", features = ["qmp", "async-tokio-all"] }
 qapi-spec = "0.3.1"
 qapi-qmp = "0.14.0"
@@ -77,6 +76,7 @@ cloud-hypervisor = ["ch-config"]

 [dev-dependencies]
 serial_test = "2.0.0"
+tempfile = { workspace = true }

 # Local dev-dependencies
 # Force the CH tests to run, even when the feature is not enabled for
@@ -85,7 +85,7 @@ hypervisor = { workspace = true, features = ["cloud-hypervisor"] }
 test-utils = { workspace = true }

 [build-dependencies]
-ttrpc-codegen = "0.4.2"
+ttrpc-codegen = "0.6.0"

 [lints.rust]
 unexpected_cfgs = { level = "warn", check-cfg = [
--- a/src/runtime-rs/crates/hypervisor/ch-config/src/convert.rs
+++ b/src/runtime-rs/crates/hypervisor/ch-config/src/convert.rs
@@ -109,6 +109,7 @@ impl TryFrom<NamedHypervisorConfig> for VmConfig {

        let fs = n.shared_fs_devices;
        let net = n.network_devices;
+        let host_devices = n.host_devices;

        let cpus = CpusConfig::try_from((cfg.cpu_info, guest_protection_to_use.clone()))
            .map_err(VmConfigError::CPUError)?;
@@ -197,6 +198,7 @@ impl TryFrom<NamedHypervisorConfig> for VmConfig {
            payload,
            fs,
            net,
+            devices: host_devices,
            pmem,
            disks,
            vsock: Some(vsock),
--- a/src/runtime-rs/crates/hypervisor/ch-config/src/lib.rs
+++ b/src/runtime-rs/crates/hypervisor/ch-config/src/lib.rs
@@ -491,6 +491,7 @@ pub struct NamedHypervisorConfig {

    pub shared_fs_devices: Option<Vec<FsConfig>>,
    pub network_devices: Option<Vec<NetConfig>>,
+    pub host_devices: Option<Vec<DeviceConfig>>,

    // Set to the available guest protection *iff* BOTH of the following
    // conditions are true:
--- a/src/runtime-rs/crates/hypervisor/src/ch/inner_device.rs
+++ b/src/runtime-rs/crates/hypervisor/src/ch/inner_device.rs
@@ -61,6 +61,7 @@ impl CloudHypervisorInner {
            match device {
                DeviceType::ShareFs(_) => self.pending_devices.insert(0, device.clone()),
                DeviceType::Network(_) => self.pending_devices.insert(0, device.clone()),
+                DeviceType::Vfio(_) => self.pending_devices.insert(0, device.clone()),
                _ => {
                    debug!(
                        sl!(),
@@ -365,9 +366,14 @@ impl CloudHypervisorInner {

    pub(crate) async fn get_shared_devices(
        &mut self,
-    ) -> Result<(Option<Vec<FsConfig>>, Option<Vec<NetConfig>>)> {
+    ) -> Result<(
+        Option<Vec<FsConfig>>,
+        Option<Vec<NetConfig>>,
+        Option<Vec<DeviceConfig>>,
+    )> {
        let mut shared_fs_devices = Vec::<FsConfig>::new();
        let mut network_devices = Vec::<NetConfig>::new();
+        let mut host_devices = Vec::<DeviceConfig>::new();

        while let Some(dev) = self.pending_devices.pop() {
            match dev {
@@ -382,11 +388,38 @@ impl CloudHypervisorInner {
                    let net_config = NetConfig::try_from(net_device.config)?;
                    network_devices.push(net_config);
                }
+                DeviceType::Vfio(vfio_device) => {
+                    // A device with multi-funtions, or a IOMMU group with one more
+                    // devices, the Primary device is selected to be passed to VM.
+                    // And the the first one is Primary device.
+                    // safe here, devices is not empty.
+                    let primary_device = vfio_device.devices.first().ok_or(anyhow!(
+                        "Primary device list empty for vfio device {:?}",
+                        vfio_device
+                    ))?;
+
+                    let primary_device = primary_device.clone();
+                    let sysfsdev = primary_device.sysfs_path.clone();
+                    let device_config = DeviceConfig {
+                        path: PathBuf::from(sysfsdev),
+                        iommu: false,
+                        ..Default::default()
+                    };
+                    info!(
+                        sl!(),
+                        "get host_devices primary device {:?}", primary_device
+                    );
+                    host_devices.push(device_config);
+                }
                _ => continue,
            }
        }

-        Ok((Some(shared_fs_devices), Some(network_devices)))
+        Ok((
+            Some(shared_fs_devices),
+            Some(network_devices),
+            Some(host_devices),
+        ))
    }
 }

--- a/src/runtime-rs/crates/hypervisor/src/ch/inner_hypervisor.rs
+++ b/src/runtime-rs/crates/hypervisor/src/ch/inner_hypervisor.rs
@@ -185,8 +185,7 @@ impl CloudHypervisorInner {
    }

    async fn boot_vm(&mut self) -> Result<()> {
-        let (shared_fs_devices, network_devices) = self.get_shared_devices().await?;
-
+        let (shared_fs_devices, network_devices, host_devices) = self.get_shared_devices().await?;
        let socket = self
            .api_socket
            .as_ref()
@@ -215,6 +214,7 @@ impl CloudHypervisorInner {
            guest_protection_to_use: self.guest_protection_to_use.clone(),
            shared_fs_devices,
            network_devices,
+            host_devices,
        };

        let cfg = VmConfig::try_from(named_cfg)?;
@@ -1093,7 +1093,7 @@ mod tests {
    use test_utils::{assert_result, skip_if_not_root};

    use std::fs::File;
-    use tempdir::TempDir;
+    use tempfile::Builder;

    fn set_fake_guest_protection(protection: Option<GuestProtection>) {
        let existing_ref = FAKE_GUEST_PROTECTION.clone();
@@ -1486,7 +1486,7 @@ mod tests {
        let path_dir = "/tmp/proc";
        let file_name = "1";

-        let tmp_dir = TempDir::new(path_dir).unwrap();
+        let tmp_dir = Builder::new().prefix("proc").tempdir().unwrap();
        let file_path = tmp_dir.path().join(file_name);
        let _tmp_file = File::create(file_path.as_os_str()).unwrap();
        let file_path_name = file_path.as_path().to_str().map(|s| s.to_string());
--- a/src/runtime-rs/crates/hypervisor/src/remote/inner.rs
+++ b/src/runtime-rs/crates/hypervisor/src/remote/inner.rs
@@ -14,7 +14,8 @@ use kata_types::{
        cri_containerd::{SANDBOX_NAMESPACE_LABEL_KEY, SANDBOX_NAME_LABEL_KEY},
        KATA_ANNO_CFG_HYPERVISOR_DEFAULT_GPUS, KATA_ANNO_CFG_HYPERVISOR_DEFAULT_GPU_MODEL,
        KATA_ANNO_CFG_HYPERVISOR_DEFAULT_MEMORY, KATA_ANNO_CFG_HYPERVISOR_DEFAULT_VCPUS,
-        KATA_ANNO_CFG_HYPERVISOR_IMAGE_PATH, KATA_ANNO_CFG_HYPERVISOR_MACHINE_TYPE,
+        KATA_ANNO_CFG_HYPERVISOR_IMAGE_PATH, KATA_ANNO_CFG_HYPERVISOR_INIT_DATA,
+        KATA_ANNO_CFG_HYPERVISOR_MACHINE_TYPE,
    },
    capabilities::{Capabilities, CapabilityBits},
 };
@@ -125,6 +126,10 @@ impl RemoteInner {
            KATA_ANNO_CFG_HYPERVISOR_IMAGE_PATH.to_string(),
            config.boot_info.image.to_string(),
        );
+        annotations.insert(
+            KATA_ANNO_CFG_HYPERVISOR_INIT_DATA.to_string(),
+            config.security_info.initdata.to_string(),
+        );
        annotations.insert(
            KATA_ANNO_CFG_HYPERVISOR_DEFAULT_GPUS.to_string(),
            config.remote_info.default_gpus.to_string(),
--- a/src/runtime-rs/crates/resource/src/coco_data/initdata_block.rs
+++ b/src/runtime-rs/crates/resource/src/coco_data/initdata_block.rs
@@ -6,7 +6,7 @@
 use flate2::{Compression, GzBuilder};
 use std::{
    fmt, fs,
-    io::{self, BufWriter, Seek, Write},
+    io::{self, BufWriter, Write},
    path::{Path, PathBuf},
 };
 use tempfile::NamedTempFile;
@@ -159,7 +159,7 @@ fn create_compressed_block(
    writer.write_all(MAGIC_HEADER)?;
    info!(sl!(), "Magic header written: {:?}", MAGIC_HEADER);

-    // 7. Configure compression level and initialize GZ writer
+    // 7. First compress data to get the actual compressed size
    let compression =
        compression_level.map_or(Compression::best(), |lvl| Compression::new(lvl.min(9)));

@@ -169,22 +169,24 @@ fn create_compressed_block(
        compression.level()
    );

-    let mut gz = GzBuilder::new()
-        .filename("initdata.toml") // Embed original filename metadata
-        .comment("Generated by Confidential Containers")
-        .write(writer, compression);
+    // Compress data to a temporary buffer first to get the compressed size
+    let mut compressed_data = Vec::new();
+    {
+        let mut gz = GzBuilder::new()
+            .filename("initdata.toml") // Embed original filename metadata
+            .comment("Generated by Confidential Containers")
+            .write(&mut compressed_data, compression);

-    // 8. Write data in chunks to avoid large memory allocation
-    let mut bytes_written = 0;
-    for chunk in initdata.as_bytes().chunks(buffer_size) {
-        bytes_written += gz.write(chunk)?;
+        // Write data in chunks to avoid large memory allocation
+        for chunk in initdata.as_bytes().chunks(buffer_size) {
+            gz.write_all(chunk)?;
+        }
+
+        // Finalize compression
+        gz.finish()?;
    }
-    info!(sl!(), "written {} bytes", bytes_written);
-
-    // 9. Finalize compression and retrieve writer
-    let mut writer = gz.finish()?;
-    let compressed_size = writer.stream_position()?;

+    let compressed_size = compressed_data.len() as u64;
    info!(
        sl!(),
        "Data compressed: {} -> {} bytes (ratio: {:.2}%)",
@@ -193,8 +195,19 @@ fn create_compressed_block(
        (compressed_size as f64 / initdata_size as f64) * 100.0
    );

+    // 8. Write compressed data length (8 bytes, little-endian)
+    writer.write_all(&compressed_size.to_le_bytes())?;
+    info!(
+        sl!(),
+        "Compressed data length written: {} bytes", compressed_size
+    );
+
+    // 9. Write compressed data
+    writer.write_all(&compressed_data)?;
+    info!(sl!(), "Compressed data written");
+
    // 10. Calculate padding for sector alignment
-    let current_pos = compressed_size;
+    let current_pos = MAGIC_HEADER.len() as u64 + 8 + compressed_size; // magic + length + data
    let padding = (SECTOR_SIZE - (current_pos % SECTOR_SIZE)) % SECTOR_SIZE;

    // 11. Zero-byte padding using small blocks
--- a/src/runtime-rs/crates/resource/src/rootfs/virtual_volume.rs
+++ b/src/runtime-rs/crates/resource/src/rootfs/virtual_volume.rs
@@ -9,6 +9,7 @@ use std::{collections::HashMap, path::PathBuf};

 use anyhow::{anyhow, Context, Result};
 use async_trait::async_trait;
+use kata_types::mount::ImagePullVolume;
 use oci_spec::runtime as oci;
 use serde_json;
 use tokio::sync::RwLock;
@@ -17,13 +18,12 @@ use hypervisor::device::device_manager::DeviceManager;
 use kata_types::{
    annotations,
    container::ContainerType,
-    mount::{KataVirtualVolume, KATA_VIRTUAL_VOLUME_IMAGE_GUEST_PULL},
+    mount::{KataVirtualVolume, KATA_VIRTUAL_VOLUME_IMAGE_GUEST_PULL, KATA_VIRTUAL_VOLUME_PREFIX},
 };

 /// Image guest-pull related consts
 const KUBERNETES_CRI_IMAGE_NAME: &str = "io.kubernetes.cri.image-name";
 const KUBERNETES_CRIO_IMAGE_NAME: &str = "io.kubernetes.cri-o.ImageName";
-const KATA_VIRTUAL_VOLUME_PREFIX: &str = "io.katacontainers.volume=";
 const KATA_VIRTUAL_VOLUME_TYPE_OVERLAY_FS: &str = "overlayfs";
 const KATA_GUEST_ROOT_SHARED_FS: &str = "/run/kata-containers/";

@@ -85,11 +85,16 @@ fn handle_virtual_volume_storage(

        let mut virtual_volume_info = virt_volume.clone();
        // Merge metadata
-        for (k, v) in annotations.iter() {
-            if let Some(ref mut image_pull) = virtual_volume_info.image_pull {
+        if let Some(ref mut image_pull) = virtual_volume_info.image_pull {
+            for (k, v) in annotations.iter() {
                image_pull.metadata.insert(k.to_owned(), v.to_owned());
            }
+        } else {
+            virtual_volume_info.image_pull = Some(ImagePullVolume {
+                metadata: annotations.clone(),
+            });
        }
+
        // Serialize ImagePull as JSON
        let image_pull_info = serde_json::to_string(&virtual_volume_info.image_pull)
            .map_err(|e| anyhow!(e.to_string()))?;
--- a/src/runtime-rs/crates/runtimes/Cargo.toml
+++ b/src/runtime-rs/crates/runtimes/Cargo.toml
@@ -31,7 +31,7 @@ serde_json = { workspace = true }
 nix = "0.25.0"
 url = { workspace = true }
 procfs = "0.12.0"
-prometheus = { version = "0.13.0", features = ["process"] }
+prometheus = { version = "0.14.0", features = ["process"] }
 oci-spec = { workspace = true }

 # Local dependencies
--- a/src/runtime-rs/crates/service/src/manager.rs
+++ b/src/runtime-rs/crates/service/src/manager.rs
@@ -139,12 +139,12 @@ impl ServiceManager {

    fn registry_service(&mut self) -> Result<()> {
        if let Some(s) = self.server.take() {
-            let sandbox_service = Arc::new(Box::new(SandboxService::new(self.handler.clone()))
-                as Box<dyn sandbox_async::Sandbox + Send + Sync>);
+            let sandbox_service: Arc<dyn sandbox_async::Sandbox + Send + Sync> =
+                Arc::new(SandboxService::new(self.handler.clone()));
            let s = s.register_service(sandbox_async::create_sandbox(sandbox_service));

-            let task_service = Arc::new(Box::new(TaskService::new(self.handler.clone()))
-                as Box<dyn shim_async::Task + Send + Sync>);
+            let task_service: Arc<dyn shim_async::Task + Send + Sync> =
+                Arc::new(TaskService::new(self.handler.clone()));
            let s = s.register_service(shim_async::create_task(task_service));
            self.server = Some(s);
        }
--- a/src/runtime-rs/crates/shim/Cargo.toml
+++ b/src/runtime-rs/crates/shim/Cargo.toml
@@ -5,7 +5,7 @@ authors = { workspace = true }
 description = "Containerd shim runtime for Kata Containers"
 keywords = ["kata-containers", "shim"]
 repository = "https://github.com/kata-containers/kata-containers.git"
-license  = { workspace = true }
+license = { workspace = true }
 edition = { workspace = true }

 [[bin]]
@@ -14,20 +14,28 @@ path = "src/bin/main.rs"

 [dependencies]
 anyhow = { workspace = true }
-backtrace = {version = ">=0.3.35", features = ["libunwind", "libbacktrace", "std"], default-features = false}
+backtrace = { version = ">=0.3.35", features = [
+    "libunwind",
+    "libbacktrace",
+    "std",
+], default-features = false }
 containerd-shim-protos = { workspace = true }
 go-flag = { workspace = true }
 libc = { workspace = true }
 log = { workspace = true }
-nix  = { workspace = true }
+nix = { workspace = true }
 protobuf = { workspace = true }
 sha2 = "=0.9.3"
-slog = {workspace = true, features = ["std", "release_max_level_trace", "max_level_trace"]}
+slog = { workspace = true, features = [
+    "std",
+    "release_max_level_trace",
+    "max_level_trace",
+] }
 slog-async = "2.5.2"
 slog-scope = { workspace = true }
 slog-stdlog = "4.1.0"
 thiserror = { workspace = true }
-tokio = { workspace = true, features = [ "rt", "rt-multi-thread" ] }
+tokio = { workspace = true, features = ["rt", "rt-multi-thread"] }
 unix_socket2 = "0.5.4"
 tracing = { workspace = true }
 tracing-opentelemetry = { workspace = true }
@@ -44,7 +52,7 @@ runtimes = { workspace = true }
 [dev-dependencies]
 tempfile = { workspace = true }
 rand = { workspace = true }
-serial_test = "0.5.1"
+serial_test = "0.10.0"

 # Local dev-dependencies
 tests_utils = { workspace = true }
--- a/src/runtime/Makefile
+++ b/src/runtime/Makefile
@@ -106,7 +106,6 @@ GENERATED_VARS = \
 		CONFIG_QEMU_NVIDIA_GPU_IN \
 		CONFIG_QEMU_NVIDIA_GPU_SNP_IN \
 		CONFIG_QEMU_NVIDIA_GPU_TDX_IN \
-		CONFIG_QEMU_SEV_IN \
 		CONFIG_QEMU_TDX_IN \
 		CONFIG_QEMU_SNP_IN \
 		CONFIG_CLH_IN \
@@ -149,7 +148,6 @@ FIRMWAREVOLUMEPATH :=
 FIRMWARETDVFPATH := PLACEHOLDER_FOR_DISTRO_OVMF_WITH_TDX_SUPPORT
 FIRMWARETDVFVOLUMEPATH :=

-FIRMWARESEVPATH := $(PREFIXDEPS)/share/ovmf/OVMF.fd
 FIRMWARESNPPATH := $(PREFIXDEPS)/share/ovmf/AMDSEV.fd

 ROOTMEASURECONFIG ?= ""
@@ -177,6 +175,10 @@ QEMUVALIDHYPERVISORPATHS := [\"$(QEMUPATH)\"]
 #QEMUTDXPATH := $(QEMUBINDIR)/$(QEMUTDXCMD)
 QEMUTDXPATH := PLACEHOLDER_FOR_DISTRO_QEMU_WITH_TDX_SUPPORT
 QEMUTDXVALIDHYPERVISORPATHS := [\"$(QEMUTDXPATH)\"]
+
+QEMUTDXEXPERIMENTALPATH := $(QEMUBINDIR)/$(QEMUTDXEXPERIMENTALCMD)
+QEMUTDXEXPERIMENTALVALIDHYPERVISORPATHS := [\"$(QEMUTDXEXPERIMENTALPATH)\"]
+
 QEMUTDXQUOTEGENERATIONSERVICESOCKETPORT := 4050

 QEMUSNPPATH := $(QEMUBINDIR)/$(QEMUSNPCMD)
@@ -238,12 +240,12 @@ DEFVALIDENTROPYSOURCES := [\"/dev/urandom\",\"/dev/random\",\"\"]
 DEFDISABLEBLOCK := false
 DEFSHAREDFS_CLH_VIRTIOFS := virtio-fs
 DEFSHAREDFS_QEMU_VIRTIOFS := virtio-fs
-# Please keep DEFSHAREDFS_QEMU_COCO_DEV_VIRTIOFS in sync with TDX/SEV/SNP
+# Please keep DEFSHAREDFS_QEMU_COCO_DEV_VIRTIOFS in sync with TDX/SNP
 DEFSHAREDFS_QEMU_COCO_DEV_VIRTIOFS := none
 DEFSHAREDFS_STRATOVIRT_VIRTIOFS := virtio-fs
 DEFSHAREDFS_QEMU_TDX_VIRTIOFS := none
-DEFSHAREDFS_QEMU_SEV_VIRTIOFS := none
 DEFSHAREDFS_QEMU_SNP_VIRTIOFS := none
+DEFSHAREDFS_QEMU_SEL_VIRTIOFS := none
 DEFVIRTIOFSDAEMON := $(LIBEXECDIR)/virtiofsd
 DEFVALIDVIRTIOFSDAEMONPATHS := [\"$(DEFVIRTIOFSDAEMON)\"]
 # Default DAX mapping cache size in MiB
@@ -345,18 +347,6 @@ ifneq (,$(QEMUCMD))

    CONFIGS += $(CONFIG_QEMU_TDX)

-    CONFIG_FILE_QEMU_SEV = configuration-qemu-sev.toml
-    CONFIG_QEMU_SEV = config/$(CONFIG_FILE_QEMU_SEV)
-    CONFIG_QEMU_SEV_IN = $(CONFIG_QEMU_SEV).in
-
-    CONFIG_PATH_QEMU_SEV = $(abspath $(CONFDIR)/$(CONFIG_FILE_QEMU_SEV))
-    CONFIG_PATHS += $(CONFIG_PATH_QEMU_SEV)
-
-    SYSCONFIG_QEMU_SEV = $(abspath $(SYSCONFDIR)/$(CONFIG_FILE_QEMU_SEV))
-    SYSCONFIG_PATHS_SEV += $(SYSCONFIG_QEMU_SEV)
-
-    CONFIGS += $(CONFIG_QEMU_SEV)
-
    CONFIG_FILE_QEMU_SNP = configuration-qemu-snp.toml
    CONFIG_QEMU_SNP = config/$(CONFIG_FILE_QEMU_SNP)
    CONFIG_QEMU_SNP_IN = $(CONFIG_QEMU_SNP).in
@@ -660,7 +650,6 @@ USER_VARS += KERNELPATH_FC
 USER_VARS += KERNELPATH_STRATOVIRT
 USER_VARS += KERNELVIRTIOFSPATH
 USER_VARS += FIRMWAREPATH
-USER_VARS += FIRMWARESEVPATH
 USER_VARS += FIRMWARETDVFPATH
 USER_VARS += FIRMWAREVOLUMEPATH
 USER_VARS += FIRMWARETDVFVOLUMEPATH
@@ -689,13 +678,16 @@ USER_VARS += PROJECT_URL
 USER_VARS += QEMUBINDIR
 USER_VARS += QEMUCMD
 USER_VARS += QEMUTDXCMD
+USER_VARS += QEMUTDXEXPERIMENTALCMD
 USER_VARS += QEMUSNPCMD
 USER_VARS += QEMUPATH
 USER_VARS += QEMUTDXPATH
+USER_VARS += QEMUTDXEXPERIMENTALPATH
 USER_VARS += QEMUTDXQUOTEGENERATIONSERVICESOCKETPORT
 USER_VARS += QEMUSNPPATH
 USER_VARS += QEMUVALIDHYPERVISORPATHS
 USER_VARS += QEMUTDXVALIDHYPERVISORPATHS
+USER_VARS += QEMUTDXEXPERIMENTALVALIDHYPERVISORPATHS
 USER_VARS += QEMUSNPVALIDHYPERVISORPATHS
 USER_VARS += QEMUVIRTIOFSCMD
 USER_VARS += QEMUVIRTIOFSPATH
@@ -728,8 +720,8 @@ USER_VARS += DEFSHAREDFS_QEMU_VIRTIOFS
 USER_VARS += DEFSHAREDFS_QEMU_COCO_DEV_VIRTIOFS
 USER_VARS += DEFSHAREDFS_STRATOVIRT_VIRTIOFS
 USER_VARS += DEFSHAREDFS_QEMU_TDX_VIRTIOFS
-USER_VARS += DEFSHAREDFS_QEMU_SEV_VIRTIOFS
 USER_VARS += DEFSHAREDFS_QEMU_SNP_VIRTIOFS
+USER_VARS += DEFSHAREDFS_QEMU_SEL_VIRTIOFS
 USER_VARS += DEFVIRTIOFSDAEMON
 USER_VARS += DEFVALIDVIRTIOFSDAEMONPATHS
 USER_VARS += DEFVIRTIOFSCACHESIZE
--- a/src/runtime/arch/amd64-options.mk
+++ b/src/runtime/arch/amd64-options.mk
@@ -12,7 +12,8 @@ MACHINEACCELERATORS :=
 CPUFEATURES := pmu=off

 QEMUCMD := qemu-system-x86_64
-QEMUTDXCMD := qemu-system-x86_64-tdx-experimental
+#QEMUTDXCMD := qemu-system-x86_64
+QEMUTDXEXPERIMENTALCMD := qemu-system-x86_64-tdx-experimental
 QEMUSNPCMD := qemu-system-x86_64-snp-experimental
 TDXCPUFEATURES := pmu=off

--- a/src/runtime/config/configuration-qemu-nvidia-gpu-tdx.toml.in
+++ b/src/runtime/config/configuration-qemu-nvidia-gpu-tdx.toml.in
@@ -12,7 +12,7 @@
 # XXX:   Type: @PROJECT_TYPE@

 [hypervisor.qemu]
-path = "@QEMUTDXPATH@"
+path = "@QEMUTDXEXPERIMENTALPATH@"
 kernel = "@KERNELPATH_CONFIDENTIAL_NV@"
 initrd = "@INITRDPATH_CONFIDENTIAL_NV@"

@@ -54,7 +54,7 @@ enable_annotations = @DEFENABLEANNOTATIONS@
 # Each member of the list is a path pattern as described by glob(3).
 # The default if not set is empty (all annotations rejected.)
 # Your distribution recommends: @QEMUVALIDHYPERVISORPATHS@
-valid_hypervisor_paths = @QEMUTDXVALIDHYPERVISORPATHS@
+valid_hypervisor_paths = @QEMUTDXEXPERIMENTALVALIDHYPERVISORPATHS@

 # Optional space-separated list of options to pass to the guest kernel.
 # For example, use `kernel_params = "vsyscall=emulate"` if you are having
--- a/src/runtime/config/configuration-qemu-se.toml.in
+++ b/src/runtime/config/configuration-qemu-se.toml.in
@@ -164,7 +164,7 @@ disable_block_device_use = @DEFDISABLEBLOCK@
 #   - virtio-fs (default)
 #   - virtio-9p
 #   - virtio-fs-nydus
-shared_fs = "@DEFSHAREDFS_QEMU_VIRTIOFS@"
+shared_fs = "@DEFSHAREDFS_QEMU_SEL_VIRTIOFS@"

 # Path to vhost-user-fs daemon.
 virtio_fs_daemon = "@DEFVIRTIOFSDAEMON@"
--- a/src/runtime/config/configuration-qemu-sev.toml.in
+++ b/src/runtime/config/configuration-qemu-sev.toml.in
@@ -1,636 +0,0 @@
-# Copyright 2022 Advanced Micro Devices, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-# XXX: WARNING: this file is auto-generated.
-# XXX:
-# XXX: Source file: "@CONFIG_QEMU_SEV_IN@"
-# XXX: Project:
-# XXX:   Name: @PROJECT_NAME@
-# XXX:   Type: @PROJECT_TYPE@
-
-[hypervisor.qemu]
-path = "@QEMUPATH@"
-kernel = "@KERNELCONFIDENTIALPATH@"
-initrd = "@INITRDCONFIDENTIALPATH@"
-machine_type = "@MACHINETYPE@"
-
-# Enable confidential guest support.
-# Toggling that setting may trigger different hardware features, ranging
-# from memory encryption to both memory and CPU-state encryption and integrity.
-# The Kata Containers runtime dynamically detects the available feature set and
-# aims at enabling the largest possible one, returning an error if none is
-# available, or none is supported by the hypervisor.
-#
-# Known limitations:
-# * Does not work by design:
-#   - CPU Hotplug 
-#   - Memory Hotplug
-#   - NVDIMM devices
-#
-# Default false
-confidential_guest = true
-
-# Enable running QEMU VMM as a non-root user.
-# By default QEMU VMM run as root. When this is set to true, QEMU VMM process runs as
-# a non-root random user. See documentation for the limitations of this mode.
-# rootless = true
-
-# List of valid annotation names for the hypervisor
-# Each member of the list is a regular expression, which is the base name
-# of the annotation, e.g. "path" for io.katacontainers.config.hypervisor.path"
-enable_annotations = @DEFENABLEANNOTATIONS@
-
-# List of valid annotations values for the hypervisor
-# Each member of the list is a path pattern as described by glob(3).
-# The default if not set is empty (all annotations rejected.)
-# Your distribution recommends: @QEMUVALIDHYPERVISORPATHS@
-valid_hypervisor_paths = @QEMUVALIDHYPERVISORPATHS@
-
-# Optional space-separated list of options to pass to the guest kernel.
-# For example, use `kernel_params = "vsyscall=emulate"` if you are having
-# trouble running pre-2.15 glibc.
-#
-# WARNING: - any parameter specified here will take priority over the default
-# parameter value of the same name used to start the virtual machine.
-# Do not set values here unless you understand the impact of doing so as you
-# may stop the virtual machine from booting.
-# To see the list of default parameters, enable hypervisor debug, create a
-# container and look for 'default-kernel-parameters' log entries.
-kernel_params = "@KERNELPARAMS@"
-
-# Path to the firmware.
-# If you want that qemu uses the default firmware leave this option empty
-firmware = "@FIRMWARESEVPATH@"
-
-# Path to the firmware volume.
-# firmware TDVF or OVMF can be split into FIRMWARE_VARS.fd (UEFI variables
-# as configuration) and FIRMWARE_CODE.fd (UEFI program image). UEFI variables
-# can be customized per each user while UEFI code is kept same.
-firmware_volume = "@FIRMWAREVOLUMEPATH@"
-
-# Machine accelerators
-# comma-separated list of machine accelerators to pass to the hypervisor.
-# For example, `machine_accelerators = "nosmm,nosmbus,nosata,nopit,static-prt,nofw"`
-machine_accelerators="@MACHINEACCELERATORS@"
-
-# Qemu seccomp sandbox feature
-# comma-separated list of seccomp sandbox features to control the syscall access.
-# For example, `seccompsandbox= "on,obsolete=deny,spawn=deny,resourcecontrol=deny"`
-# Note: "elevateprivileges=deny" doesn't work with daemonize option, so it's removed from the seccomp sandbox
-# Another note: enabling this feature may reduce performance, you may enable
-# /proc/sys/net/core/bpf_jit_enable to reduce the impact. see https://man7.org/linux/man-pages/man8/bpfc.8.html
-#seccompsandbox="@DEFSECCOMPSANDBOXPARAM@"
-
-# CPU features
-# comma-separated list of cpu features to pass to the cpu
-# For example, `cpu_features = "pmu=off,vmx=off"
-cpu_features="@CPUFEATURES@"
-
-# Default number of vCPUs per SB/VM:
-# unspecified or 0                --> will be set to @DEFVCPUS@
-# < 0                             --> will be set to the actual number of physical cores
-# > 0 <= number of physical cores --> will be set to the specified number
-# > number of physical cores      --> will be set to the actual number of physical cores
-default_vcpus = 1
-
-# Default maximum number of vCPUs per SB/VM:
-# unspecified or == 0             --> will be set to the actual number of physical cores or to the maximum number
-#                                     of vCPUs supported by KVM if that number is exceeded
-# > 0 <= number of physical cores --> will be set to the specified number
-# > number of physical cores      --> will be set to the actual number of physical cores or to the maximum number
-#                                     of vCPUs supported by KVM if that number is exceeded
-# WARNING: Depending of the architecture, the maximum number of vCPUs supported by KVM is used when
-# the actual number of physical cores is greater than it.
-# WARNING: Be aware that this value impacts the virtual machine's memory footprint and CPU
-# the hotplug functionality. For example, `default_maxvcpus = 240` specifies that until 240 vCPUs
-# can be added to a SB/VM, but the memory footprint will be big. Another example, with
-# `default_maxvcpus = 8` the memory footprint will be small, but 8 will be the maximum number of
-# vCPUs supported by the SB/VM. In general, we recommend that you do not edit this variable,
-# unless you know what are you doing.
-# NOTICE: on arm platform with gicv2 interrupt controller, set it to 8.
-default_maxvcpus = @DEFMAXVCPUS@
-
-# Bridges can be used to hot plug devices.
-# Limitations:
-# * Currently only pci bridges are supported
-# * Until 30 devices per bridge can be hot plugged.
-# * Until 5 PCI bridges can be cold plugged per VM.
-#   This limitation could be a bug in qemu or in the kernel
-# Default number of bridges per SB/VM:
-# unspecified or 0   --> will be set to @DEFBRIDGES@
-# > 1 <= 5           --> will be set to the specified number
-# > 5                --> will be set to 5
-default_bridges = @DEFBRIDGES@
-
-# Default memory size in MiB for SB/VM.
-# If unspecified then it will be set @DEFMEMSZ@ MiB.
-default_memory = @DEFMEMSZ@
-#
-# Default memory slots per SB/VM.
-# If unspecified then it will be set @DEFMEMSLOTS@.
-# This is will determine the times that memory will be hotadded to sandbox/VM.
-#memory_slots = @DEFMEMSLOTS@
-
-# Default maximum memory in MiB per SB / VM
-# unspecified or == 0           --> will be set to the actual amount of physical RAM
-# > 0 <= amount of physical RAM --> will be set to the specified number
-# > amount of physical RAM      --> will be set to the actual amount of physical RAM
-default_maxmemory = @DEFMAXMEMSZ@
-
-# The size in MiB will be plused to max memory of hypervisor.
-# It is the memory address space for the NVDIMM device.
-# If set block storage driver (block_device_driver) to "nvdimm",
-# should set memory_offset to the size of block device.
-# Default 0
-#memory_offset = 0
-
-# Specifies virtio-mem will be enabled or not.
-# Please note that this option should be used with the command
-# "echo 1 > /proc/sys/vm/overcommit_memory".
-# Default false
-#enable_virtio_mem = true
-
-# Disable block device from being used for a container's rootfs.
-# In case of a storage driver like devicemapper where a container's
-# root file system is backed by a block device, the block device is passed
-# directly to the hypervisor for performance reasons.
-# This flag prevents the block device from being passed to the hypervisor,
-# virtio-fs is used instead to pass the rootfs.
-disable_block_device_use = @DEFDISABLEBLOCK@
-
-# Shared file system type:
-#   - virtio-fs (default)
-#   - virtio-9p
-#   - virtio-fs-nydus
-#   - none
-shared_fs = "@DEFSHAREDFS_QEMU_SEV_VIRTIOFS@"
-
-# Path to vhost-user-fs daemon.
-virtio_fs_daemon = "@DEFVIRTIOFSDAEMON@"
-
-# List of valid annotations values for the virtiofs daemon
-# The default if not set is empty (all annotations rejected.)
-# Your distribution recommends: @DEFVALIDVIRTIOFSDAEMONPATHS@
-valid_virtio_fs_daemon_paths = @DEFVALIDVIRTIOFSDAEMONPATHS@
-
-# Default size of DAX cache in MiB
-virtio_fs_cache_size = @DEFVIRTIOFSCACHESIZE@
-
-# Extra args for virtiofsd daemon
-#
-# Format example:
-#   ["-o", "arg1=xxx,arg2", "-o", "hello world", "--arg3=yyy"]
-# Examples:
-#   Set virtiofsd log level to debug : ["-o", "log_level=debug"] or ["-d"]
-#
-# see `virtiofsd -h` for possible options.
-virtio_fs_extra_args = @DEFVIRTIOFSEXTRAARGS@
-
-# Cache mode:
-#
-#  - none
-#    Metadata, data, and pathname lookup are not cached in guest. They are
-#    always fetched from host and any changes are immediately pushed to host.
-#
-#  - auto
-#    Metadata and pathname lookup cache expires after a configured amount of
-#    time (default is 1 second). Data is cached while the file is open (close
-#    to open consistency).
-#
-#  - always
-#    Metadata, data, and pathname lookup are cached in guest and never expire.
-virtio_fs_cache = "@DEFVIRTIOFSCACHE@"
-
-# Block storage driver to be used for the hypervisor in case the container
-# rootfs is backed by a block device. This is virtio-scsi, virtio-blk
-# or nvdimm.
-block_device_driver = "@DEFBLOCKSTORAGEDRIVER_QEMU@"
-
-# Specifies cache-related options will be set to block devices or not.
-# Default false
-#block_device_cache_set = true
-
-# Specifies cache-related options for block devices.
-# Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
-# Default false
-#block_device_cache_direct = true
-
-# Specifies cache-related options for block devices.
-# Denotes whether flush requests for the device are ignored.
-# Default false
-#block_device_cache_noflush = true
-
-# Enable iothreads (data-plane) to be used. This causes IO to be
-# handled in a separate IO thread. This is currently only implemented
-# for SCSI.
-#
-enable_iothreads = @DEFENABLEIOTHREADS@
-
-# Enable pre allocation of VM RAM, default false
-# Enabling this will result in lower container density
-# as all of the memory will be allocated and locked
-# This is useful when you want to reserve all the memory
-# upfront or in the cases where you want memory latencies
-# to be very predictable
-# Default false
-#enable_mem_prealloc = true
-
-# Enable huge pages for VM RAM, default false
-# Enabling this will result in the VM memory
-# being allocated using huge pages.
-# This is useful when you want to use vhost-user network
-# stacks within the container. This will automatically
-# result in memory pre allocation
-#enable_hugepages = true
-
-# Enable vhost-user storage device, default false
-# Enabling this will result in some Linux reserved block type
-# major range 240-254 being chosen to represent vhost-user devices.
-enable_vhost_user_store = @DEFENABLEVHOSTUSERSTORE@
-
-# The base directory specifically used for vhost-user devices.
-# Its sub-path "block" is used for block devices; "block/sockets" is
-# where we expect vhost-user sockets to live; "block/devices" is where
-# simulated block device nodes for vhost-user devices to live.
-vhost_user_store_path = "@DEFVHOSTUSERSTOREPATH@"
-
-# Enable vIOMMU, default false
-# Enabling this will result in the VM having a vIOMMU device
-# This will also add the following options to the kernel's
-# command line: intel_iommu=on,iommu=pt
-#enable_iommu = true
-
-# Enable IOMMU_PLATFORM, default false
-# Enabling this will result in the VM device having iommu_platform=on set
-#enable_iommu_platform = true
-
-# List of valid annotations values for the vhost user store path
-# The default if not set is empty (all annotations rejected.)
-# Your distribution recommends: @DEFVALIDVHOSTUSERSTOREPATHS@
-valid_vhost_user_store_paths = @DEFVALIDVHOSTUSERSTOREPATHS@
-
-# Enable file based guest memory support. The default is an empty string which
-# will disable this feature. In the case of virtio-fs, this is enabled
-# automatically and '/dev/shm' is used as the backing folder.
-# This option will be ignored if VM templating is enabled.
-#file_mem_backend = "@DEFFILEMEMBACKEND@"
-
-# List of valid annotations values for the file_mem_backend annotation
-# The default if not set is empty (all annotations rejected.)
-# Your distribution recommends: @DEFVALIDFILEMEMBACKENDS@
-valid_file_mem_backends = @DEFVALIDFILEMEMBACKENDS@
-
-# -pflash can add image file to VM. The arguments of it should be in format
-# of ["/path/to/flash0.img", "/path/to/flash1.img"]
-pflashes = []
-
-# This option changes the default hypervisor and kernel parameters
-# to enable debug output where available.
-#
-# Default false
-#enable_debug = true
-
-# Disable the customizations done in the runtime when it detects
-# that it is running on top a VMM. This will result in the runtime
-# behaving as it would when running on bare metal.
-#
-#disable_nesting_checks = true
-
-# This is the msize used for 9p shares. It is the number of bytes
-# used for 9p packet payload.
-#msize_9p = @DEFMSIZE9P@
-
-# If false and nvdimm is supported, use nvdimm device to plug guest image.
-# Otherwise virtio-block device is used.
-#
-# nvdimm is not supported when `confidential_guest = true`.
-disable_image_nvdimm = @DEFDISABLEIMAGENVDIMM@
-
-# Before hot plugging a PCIe device, you need to add a pcie_root_port device.
-# Use this parameter when using some large PCI bar devices, such as Nvidia GPU
-# The value means the number of pcie_root_port
-# Default 0
-#pcie_root_port = 2
-
-# If vhost-net backend for virtio-net is not desired, set to true. Default is false, which trades off
-# security (vhost-net runs ring0) for network I/O performance.
-#disable_vhost_net = true
-
-#
-# Default entropy source.
-# The path to a host source of entropy (including a real hardware RNG)
-# /dev/urandom and /dev/random are two main options.
-# Be aware that /dev/random is a blocking source of entropy.  If the host
-# runs out of entropy, the VMs boot time will increase leading to get startup
-# timeouts.
-# The source of entropy /dev/urandom is non-blocking and provides a
-# generally acceptable source of entropy. It should work well for pretty much
-# all practical purposes.
-#entropy_source= "@DEFENTROPYSOURCE@"
-
-# List of valid annotations values for entropy_source
-# The default if not set is empty (all annotations rejected.)
-# Your distribution recommends: @DEFVALIDENTROPYSOURCES@
-valid_entropy_sources = @DEFVALIDENTROPYSOURCES@
-
-# Path to OCI hook binaries in the *guest rootfs*.
-# This does not affect host-side hooks which must instead be added to
-# the OCI spec passed to the runtime.
-#
-# You can create a rootfs with hooks by customizing the osbuilder scripts:
-# https://github.com/kata-containers/kata-containers/tree/main/tools/osbuilder
-#
-# Hooks must be stored in a subdirectory of guest_hook_path according to their
-# hook type, i.e. "guest_hook_path/{prestart,poststart,poststop}".
-# The agent will scan these directories for executable files and add them, in
-# lexicographical order, to the lifecycle of the guest container.
-# Hooks are executed in the runtime namespace of the guest. See the official documentation:
-# https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks
-# Warnings will be logged if any error is encountered while scanning for hooks,
-# but it will not abort container execution.
-#guest_hook_path = "/usr/share/oci/hooks"
-#
-# Use rx Rate Limiter to control network I/O inbound bandwidth(size in bits/sec for SB/VM).
-# In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) to discipline traffic.
-# Default 0-sized value means unlimited rate.
-#rx_rate_limiter_max_rate = 0
-# Use tx Rate Limiter to control network I/O outbound bandwidth(size in bits/sec for SB/VM).
-# In Qemu, we use classful qdiscs HTB(Hierarchy Token Bucket) and ifb(Intermediate Functional Block)
-# to discipline traffic.
-# Default 0-sized value means unlimited rate.
-#tx_rate_limiter_max_rate = 0
-
-# Set where to save the guest memory dump file.
-# If set, when GUEST_PANICKED event occurred,
-# guest memeory will be dumped to host filesystem under guest_memory_dump_path,
-# This directory will be created automatically if it does not exist.
-#
-# The dumped file(also called vmcore) can be processed with crash or gdb.
-#
-# WARNING:
-#   Dump guest’s memory can take very long depending on the amount of guest memory
-#   and use much disk space.
-#guest_memory_dump_path="/var/crash/kata"
-
-# If enable paging.
-# Basically, if you want to use "gdb" rather than "crash",
-# or need the guest-virtual addresses in the ELF vmcore,
-# then you should enable paging.
-#
-# See: https://www.qemu.org/docs/master/qemu-qmp-ref.html#Dump-guest-memory for details
-#guest_memory_dump_paging=false
-
-# Enable swap in the guest. Default false.
-# When enable_guest_swap is enabled, insert a raw file to the guest as the swap device
-# if the swappiness of a container (set by annotation "io.katacontainers.container.resource.swappiness")
-# is bigger than 0.
-# The size of the swap device should be
-# swap_in_bytes (set by annotation "io.katacontainers.container.resource.swap_in_bytes") - memory_limit_in_bytes.
-# If swap_in_bytes is not set, the size should be memory_limit_in_bytes.
-# If swap_in_bytes and memory_limit_in_bytes is not set, the size should
-# be default_memory.
-#enable_guest_swap = true
-
-# use legacy serial for guest console if available and implemented for architecture. Default false
-#use_legacy_serial = true
-
-# disable applying SELinux on the VMM process (default false)
-disable_selinux=@DEFDISABLESELINUX@
-
-# disable applying SELinux on the container process
-# If set to false, the type `container_t` is applied to the container process by default.
-# Note: To enable guest SELinux, the guest rootfs must be CentOS that is created and built
-# with `SELINUX=yes`.
-# (default: true)
-disable_guest_selinux=@DEFDISABLEGUESTSELINUX@
-
-[factory]
-# VM templating support. Once enabled, new VMs are created from template
-# using vm cloning. They will share the same initial kernel, initramfs and
-# agent memory by mapping it readonly. It helps speeding up new container
-# creation and saves a lot of memory if there are many kata containers running
-# on the same host.
-#
-# When disabled, new VMs are created from scratch.
-#
-# Note: Requires "initrd=" to be set ("image=" is not supported).
-#
-# Default false
-#enable_template = true
-
-# Specifies the path of template.
-#
-# Default "/run/vc/vm/template"
-#template_path = "/run/vc/vm/template"
-
-# The number of caches of VMCache:
-# unspecified or == 0   --> VMCache is disabled
-# > 0                   --> will be set to the specified number
-#
-# VMCache is a function that creates VMs as caches before using it.
-# It helps speed up new container creation.
-# The function consists of a server and some clients communicating
-# through Unix socket.  The protocol is gRPC in protocols/cache/cache.proto.
-# The VMCache server will create some VMs and cache them by factory cache.
-# It will convert the VM to gRPC format and transport it when gets
-# requestion from clients.
-# Factory grpccache is the VMCache client.  It will request gRPC format
-# VM and convert it back to a VM.  If VMCache function is enabled,
-# kata-runtime will request VM from factory grpccache when it creates
-# a new sandbox.
-#
-# Default 0
-#vm_cache_number = 0
-
-# Specify the address of the Unix socket that is used by VMCache.
-#
-# Default /var/run/kata-containers/cache.sock
-#vm_cache_endpoint = "/var/run/kata-containers/cache.sock"
-
-[agent.@PROJECT_TYPE@]
-# If enabled, make the agent display debug-level messages.
-# (default: disabled)
-#enable_debug = true
-
-# Enable agent tracing.
-#
-# If enabled, the agent will generate OpenTelemetry trace spans.
-#
-# Notes:
-#
-# - If the runtime also has tracing enabled, the agent spans will be
-#   associated with the appropriate runtime parent span.
-# - If enabled, the runtime will wait for the container to shutdown,
-#   increasing the container shutdown time slightly.
-#
-# (default: disabled)
-#enable_tracing = true
-
-# Comma separated list of kernel modules and their parameters.
-# These modules will be loaded in the guest kernel using modprobe(8).
-# The following example can be used to load two kernel modules with parameters
-#  - kernel_modules=["e1000e InterruptThrottleRate=3000,3000,3000 EEE=1", "i915 enable_ppgtt=0"]
-# The first word is considered as the module name and the rest as its parameters.
-# Container will not be started when:
-#  * A kernel module is specified and the modprobe command is not installed in the guest
-#    or it fails loading the module.
-#  * The module is not available in the guest or it doesn't met the guest kernel
-#    requirements, like architecture and version.
-#
-kernel_modules=[]
-
-# Enable debug console.
-
-# If enabled, user can connect guest OS running inside hypervisor
-# through "kata-runtime exec <sandbox-id>" command
-
-#debug_console_enabled = true
-
-# Agent connection dialing timeout value in seconds
-# (default: 90)
-dial_timeout = 90
-
-[runtime]
-# If enabled, the runtime will log additional debug messages to the
-# system log
-# (default: disabled)
-#enable_debug = true
-#
-# Internetworking model
-# Determines how the VM should be connected to the
-# the container network interface
-# Options:
-#
-#   - macvtap
-#     Used when the Container network interface can be bridged using
-#     macvtap.
-#
-#   - none
-#     Used when customize network. Only creates a tap device. No veth pair.
-#
-#   - tcfilter
-#     Uses tc filter rules to redirect traffic from the network interface
-#     provided by plugin to a tap interface connected to the VM.
-#
-internetworking_model="@DEFNETWORKMODEL_QEMU@"
-
-# disable guest seccomp
-# Determines whether container seccomp profiles are passed to the virtual
-# machine and applied by the kata agent. If set to true, seccomp is not applied
-# within the guest
-# (default: true)
-disable_guest_seccomp=@DEFDISABLEGUESTSECCOMP@
-
-# Apply a custom SELinux security policy to the container process inside the VM.
-# This is used when you want to apply a type other than the default `container_t`,
-# so general users should not uncomment and apply it.
-# (format: "user:role:type")
-# Note: You cannot specify MCS policy with the label because the sensitivity levels and
-# categories are determined automatically by high-level container runtimes such as containerd.
-#guest_selinux_label="@DEFGUESTSELINUXLABEL@"
-
-# If enabled, the runtime will create opentracing.io traces and spans.
-# (See https://www.jaegertracing.io/docs/getting-started).
-# (default: disabled)
-#enable_tracing = true
-
-# Set the full url to the Jaeger HTTP Thrift collector.
-# The default if not set will be "http://localhost:14268/api/traces"
-#jaeger_endpoint = ""
-
-# Sets the username to be used if basic auth is required for Jaeger.
-#jaeger_user = ""
-
-# Sets the password to be used if basic auth is required for Jaeger.
-#jaeger_password = ""
-
-# If enabled, the runtime will not create a network namespace for shim and hypervisor processes.
-# This option may have some potential impacts to your host. It should only be used when you know what you're doing.
-# `disable_new_netns` conflicts with `internetworking_model=tcfilter` and `internetworking_model=macvtap`. It works only
-# with `internetworking_model=none`. The tap device will be in the host network namespace and can connect to a bridge
-# (like OVS) directly.
-# (default: false)
-#disable_new_netns = true
-
-# if enabled, the runtime will add all the kata processes inside one dedicated cgroup.
-# The container cgroups in the host are not created, just one single cgroup per sandbox.
-# The runtime caller is free to restrict or collect cgroup stats of the overall Kata sandbox.
-# The sandbox cgroup path is the parent cgroup of a container with the PodSandbox annotation.
-# The sandbox cgroup is constrained if there is no container type annotation.
-# See: https://pkg.go.dev/github.com/kata-containers/kata-containers/src/runtime/virtcontainers#ContainerType
-sandbox_cgroup_only=@DEFSANDBOXCGROUPONLY@
-
-# If enabled, the runtime will attempt to determine appropriate sandbox size (memory, CPU) before booting the virtual machine. In
-# this case, the runtime will not dynamically update the amount of memory and CPU in the virtual machine. This is generally helpful
-# when a hardware architecture or hypervisor solutions is utilized which does not support CPU and/or memory hotplug.
-# Compatibility for determining appropriate sandbox (VM) size:
-# - When running with pods, sandbox sizing information will only be available if using Kubernetes >= 1.23 and containerd >= 1.6. CRI-O
-#   does not yet support sandbox sizing annotations.
-# - When running single containers using a tool like ctr, container sizing information will be available.
-static_sandbox_resource_mgmt=@DEFSTATICRESOURCEMGMT_TEE@
-
-# If specified, sandbox_bind_mounts identifieds host paths to be mounted (ro) into the sandboxes shared path.
-# This is only valid if filesystem sharing is utilized. The provided path(s) will be bindmounted into the shared fs directory.
-# If defaults are utilized, these mounts should be available in the guest at `/run/kata-containers/shared/containers/sandbox-mounts`
-# These will not be exposed to the container workloads, and are only provided for potential guest services.
-sandbox_bind_mounts=@DEFBINDMOUNTS@
-
-# VFIO Mode
-# Determines how VFIO devices should be be presented to the container.
-# Options:
-#
-#  - vfio
-#    Matches behaviour of OCI runtimes (e.g. runc) as much as
-#    possible.  VFIO devices will appear in the container as VFIO
-#    character devices under /dev/vfio.  The exact names may differ
-#    from the host (they need to match the VM's IOMMU group numbers
-#    rather than the host's)
-#
-#  - guest-kernel
-#    This is a Kata-specific behaviour that's useful in certain cases.
-#    The VFIO device is managed by whatever driver in the VM kernel
-#    claims it.  This means it will appear as one or more device nodes
-#    or network interfaces depending on the nature of the device.
-#    Using this mode requires specially built workloads that know how
-#    to locate the relevant device interfaces within the VM.
-#
-vfio_mode="@DEFVFIOMODE@"
-
-# If enabled, the runtime will not create Kubernetes emptyDir mounts on the guest filesystem. Instead, emptyDir mounts will
-# be created on the host and shared via virtio-fs. This is potentially slower, but allows sharing of files from host to guest.
-disable_guest_empty_dir=@DEFDISABLEGUESTEMPTYDIR@
-
-# Enabled experimental feature list, format: ["a", "b"].
-# Experimental features are features not stable enough for production,
-# they may break compatibility, and are prepared for a big version bump.
-# Supported experimental features:
-# (default: [])
-experimental=@DEFAULTEXPFEATURES@
-
-# If enabled, user can run pprof tools with shim v2 process through kata-monitor.
-# (default: false)
-# enable_pprof = true
-
-# Indicates the CreateContainer request timeout needed for the workload(s)
-# It using guest_pull this includes the time to pull the image inside the guest
-# Defaults to @DEFCREATECONTAINERTIMEOUT@ second(s)  
-# Note: The effective timeout is determined by the lesser of two values: runtime-request-timeout from kubelet config 
-# (https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/#:~:text=runtime%2Drequest%2Dtimeout) and create_container_timeout. 
-# In essence, the timeout used for guest pull=runtime-request-timeout<create_container_timeout?runtime-request-timeout:create_container_timeout.
-create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
-
-# Base directory of directly attachable network config.
-# Network devices for VM-based containers are allowed to be placed in the
-# host netns to eliminate as many hops as possible, which is what we
-# called a "Directly Attachable Network". The config, set by special CNI
-# plugins, is used to tell the Kata containers what devices are attached
-# to the hypervisor.
-# (default: /run/kata-containers/dans)
-dan_conf = "@DEFDANCONF@"
-
-# Enforce guest pull. This instructs the runtime to communicate to the agent via annotations that
-# the container image should be pulled in the guest, without using an external snapshotter.
-# This is an experimental feature and might be removed in the future.
-experimental_force_guest_pull = @DEFFORCEGUESTPULL@
--- a/src/runtime/pkg/README.md
+++ b/src/runtime/pkg/README.md
@@ -7,5 +7,4 @@ This repository contains a number of packages in addition to the
 |-|-|
 | [`katatestutils`](katatestutils) | Unit test utilities. |
 | [`katautils`](katautils) | Utilities. |
-| [`sev`](sev) | AMD SEV confidential guest utilities. |
 | [`signals`](signals) | Signal handling functions. |
--- a/src/runtime/pkg/sev/README.md
+++ b/src/runtime/pkg/sev/README.md
@@ -1,14 +0,0 @@
-# AMD SEV confidential guest utilities
-
-This package provides utilities for launching AMD SEV confidential guests.
-
-## Calculating expected launch digests
-
-The `CalculateLaunchDigest` function can be used to calculate the expected
-SHA-256 of an SEV confidential guest given its firmware, kernel, initrd, and
-kernel command-line.
-
-### Unit test data
-
-The [`testdata`](testdata) directory contains file used for testing
-`CalculateLaunchDigest`.
--- a/src/runtime/pkg/sev/kbs/kbs.go
+++ b/src/runtime/pkg/sev/kbs/kbs.go
@@ -1,33 +0,0 @@
-// Copyright contributors to AMD SEV/-ES in Go
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-// Package kbs can be used interact with simple-kbs, the key broker
-// server for SEV and SEV-ES pre-attestation
-
-package kbs
-
-const (
-	Offline           = "offline"
-	OfflineSecretType = "bundle"
-	OfflineSecretGuid = "e6f5a162-d67f-4750-a67c-5d065f2a9910"
-	Online            = "online"
-	OnlineBootParam   = "online_sev_kbc"
-	OnlineSecretType  = "connection"
-	OnlineSecretGuid  = "1ee27366-0c87-43a6-af48-28543eaf7cb0"
-)
-
-type GuestPreAttestationConfig struct {
-	Proxy            string
-	Keyset           string
-	LaunchId         string
-	KernelPath       string
-	InitrdPath       string
-	FwPath           string
-	KernelParameters string
-	CertChainPath    string
-	SecretType       string
-	SecretGuid       string
-	Policy           uint32
-}
--- a/src/runtime/pkg/sev/ovmf.go
+++ b/src/runtime/pkg/sev/ovmf.go
@@ -1,101 +0,0 @@
-// Copyright contributors to AMD SEV/-ES in Go
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sev
-
-import (
-	"bytes"
-	"encoding/binary"
-	"errors"
-	"os"
-)
-
-// GUID 96b582de-1fb2-45f7-baea-a366c55a082d
-var ovmfTableFooterGuid = guidLE{0xde, 0x82, 0xb5, 0x96, 0xb2, 0x1f, 0xf7, 0x45, 0xba, 0xea, 0xa3, 0x66, 0xc5, 0x5a, 0x08, 0x2d}
-
-// GUID 00f771de-1a7e-4fcb-890e-68c77e2fb44e
-var sevEsResetBlockGuid = guidLE{0xde, 0x71, 0xf7, 0x00, 0x7e, 0x1a, 0xcb, 0x4f, 0x89, 0x0e, 0x68, 0xc7, 0x7e, 0x2f, 0xb4, 0x4e}
-
-type ovmfFooterTableEntry struct {
-	Size uint16
-	Guid guidLE
-}
-
-type ovmf struct {
-	table map[guidLE][]byte
-}
-
-func NewOvmf(filename string) (ovmf, error) {
-	buf, err := os.ReadFile(filename)
-	if err != nil {
-		return ovmf{}, err
-	}
-	table, err := parseFooterTable(buf)
-	if err != nil {
-		return ovmf{}, err
-	}
-	return ovmf{table}, nil
-}
-
-// Parse the OVMF footer table and return a map from GUID to entry value
-func parseFooterTable(data []byte) (map[guidLE][]byte, error) {
-	table := make(map[guidLE][]byte)
-
-	buf := new(bytes.Buffer)
-	err := binary.Write(buf, binary.LittleEndian, ovmfFooterTableEntry{})
-	if err != nil {
-		return table, err
-	}
-	entryHeaderSize := buf.Len()
-
-	// The OVMF table ends 32 bytes before the end of the firmware binary
-	startOfFooterTable := len(data) - 32 - entryHeaderSize
-	footerBytes := bytes.NewReader(data[startOfFooterTable:])
-	var footer ovmfFooterTableEntry
-	err = binary.Read(footerBytes, binary.LittleEndian, &footer)
-	if err != nil {
-		return table, err
-	}
-	if footer.Guid != ovmfTableFooterGuid {
-		// No OVMF footer table
-		return table, nil
-	}
-	tableSize := int(footer.Size) - entryHeaderSize
-	if tableSize < 0 {
-		return table, nil
-	}
-	tableBytes := data[(startOfFooterTable - tableSize):startOfFooterTable]
-	for len(tableBytes) >= entryHeaderSize {
-		tsize := len(tableBytes)
-		entryBytes := bytes.NewReader(tableBytes[tsize-entryHeaderSize:])
-		var entry ovmfFooterTableEntry
-		err := binary.Read(entryBytes, binary.LittleEndian, &entry)
-		if err != nil {
-			return table, err
-		}
-		if int(entry.Size) < entryHeaderSize {
-			return table, errors.New("Invalid entry size")
-		}
-		entryData := tableBytes[tsize-int(entry.Size) : tsize-entryHeaderSize]
-		table[entry.Guid] = entryData
-		tableBytes = tableBytes[:tsize-int(entry.Size)]
-	}
-	return table, nil
-}
-
-func (o *ovmf) tableItem(guid guidLE) ([]byte, error) {
-	value, ok := o.table[guid]
-	if !ok {
-		return []byte{}, errors.New("OVMF footer table entry not found")
-	}
-	return value, nil
-}
-
-func (o *ovmf) sevEsResetEip() (uint32, error) {
-	value, err := o.tableItem(sevEsResetBlockGuid)
-	if err != nil {
-		return 0, err
-	}
-	return binary.LittleEndian.Uint32(value), nil
-}
--- a/src/runtime/pkg/sev/sev.go
+++ b/src/runtime/pkg/sev/sev.go
@@ -1,203 +0,0 @@
-// Copyright contributors to AMD SEV/-ES in Go
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-// Package sev can be used to compute the expected hash values for
-// SEV/-ES pre-launch attestation
-package sev
-
-import (
-	"bytes"
-	"crypto/sha256"
-	"encoding/binary"
-	"io"
-	"os"
-)
-
-type guidLE [16]byte
-
-// The following definitions must be identical to those in QEMU target/i386/sev.c
-
-// GUID: 9438d606-4f22-4cc9-b479-a793d411fd21
-var sevHashTableHeaderGuid = guidLE{0x06, 0xd6, 0x38, 0x94, 0x22, 0x4f, 0xc9, 0x4c, 0xb4, 0x79, 0xa7, 0x93, 0xd4, 0x11, 0xfd, 0x21}
-
-// GUID: 4de79437-abd2-427f-b835-d5b172d2045b
-var sevKernelEntryGuid = guidLE{0x37, 0x94, 0xe7, 0x4d, 0xd2, 0xab, 0x7f, 0x42, 0xb8, 0x35, 0xd5, 0xb1, 0x72, 0xd2, 0x04, 0x5b}
-
-// GUID: 44baf731-3a2f-4bd7-9af1-41e29169781d
-var sevInitrdEntryGuid = guidLE{0x31, 0xf7, 0xba, 0x44, 0x2f, 0x3a, 0xd7, 0x4b, 0x9a, 0xf1, 0x41, 0xe2, 0x91, 0x69, 0x78, 0x1d}
-
-// GUID: 97d02dd8-bd20-4c94-aa78-e7714d36ab2a
-var sevCmdlineEntryGuid = guidLE{0xd8, 0x2d, 0xd0, 0x97, 0x20, 0xbd, 0x94, 0x4c, 0xaa, 0x78, 0xe7, 0x71, 0x4d, 0x36, 0xab, 0x2a}
-
-type sevHashTableEntry struct {
-	entryGuid guidLE
-	length    uint16
-	hash      [sha256.Size]byte
-}
-
-type sevHashTable struct {
-	tableGuid guidLE
-	length    uint16
-	cmdline   sevHashTableEntry
-	initrd    sevHashTableEntry
-	kernel    sevHashTableEntry
-}
-
-type paddedSevHashTable struct {
-	table   sevHashTable
-	padding [8]byte
-}
-
-func fileSha256(filename string) (res [sha256.Size]byte, err error) {
-	f, err := os.Open(filename)
-	if err != nil {
-		return res, err
-	}
-	defer f.Close()
-
-	digest := sha256.New()
-	if _, err := io.Copy(digest, f); err != nil {
-		return res, err
-	}
-
-	copy(res[:], digest.Sum(nil))
-	return res, nil
-}
-
-func constructSevHashesTable(kernelPath, initrdPath, cmdline string) ([]byte, error) {
-	kernelHash, err := fileSha256(kernelPath)
-	if err != nil {
-		return []byte{}, err
-	}
-
-	initrdHash, err := fileSha256(initrdPath)
-	if err != nil {
-		return []byte{}, err
-	}
-
-	cmdlineHash := sha256.Sum256(append([]byte(cmdline), 0))
-
-	buf := new(bytes.Buffer)
-	err = binary.Write(buf, binary.LittleEndian, sevHashTableEntry{})
-	if err != nil {
-		return []byte{}, err
-	}
-	entrySize := uint16(buf.Len())
-
-	buf = new(bytes.Buffer)
-	err = binary.Write(buf, binary.LittleEndian, sevHashTable{})
-	if err != nil {
-		return []byte{}, err
-	}
-	tableSize := uint16(buf.Len())
-
-	ht := paddedSevHashTable{
-		table: sevHashTable{
-			tableGuid: sevHashTableHeaderGuid,
-			length:    tableSize,
-			cmdline: sevHashTableEntry{
-				entryGuid: sevCmdlineEntryGuid,
-				length:    entrySize,
-				hash:      cmdlineHash,
-			},
-			initrd: sevHashTableEntry{
-				entryGuid: sevInitrdEntryGuid,
-				length:    entrySize,
-				hash:      initrdHash,
-			},
-			kernel: sevHashTableEntry{
-				entryGuid: sevKernelEntryGuid,
-				length:    entrySize,
-				hash:      kernelHash,
-			},
-		},
-		padding: [8]byte{0, 0, 0, 0, 0, 0, 0, 0},
-	}
-
-	htBuf := new(bytes.Buffer)
-	err = binary.Write(htBuf, binary.LittleEndian, ht)
-	if err != nil {
-		return []byte{}, err
-	}
-	return htBuf.Bytes(), nil
-}
-
-// CalculateLaunchDigest returns the sha256 encoded SEV launch digest based off
-// the current firmware, kernel, initrd, and the kernel cmdline
-func CalculateLaunchDigest(firmwarePath, kernelPath, initrdPath, cmdline string) (res [sha256.Size]byte, err error) {
-	f, err := os.Open(firmwarePath)
-	if err != nil {
-		return res, err
-	}
-	defer f.Close()
-
-	digest := sha256.New()
-	if _, err := io.Copy(digest, f); err != nil {
-		return res, err
-	}
-
-	// When used for confidential containers in kata-containers, kernelPath
-	// is always set (direct boot).  However, this current package can also
-	// be used by other programs which may calculate launch digests of
-	// arbitrary SEV guests without SEV kernel hashes table.
-	if kernelPath != "" {
-		ht, err := constructSevHashesTable(kernelPath, initrdPath, cmdline)
-		if err != nil {
-			return res, err
-		}
-		digest.Write(ht)
-	}
-
-	copy(res[:], digest.Sum(nil))
-	return res, nil
-}
-
-// CalculateSEVESLaunchDigest returns the sha256 encoded SEV-ES launch digest
-// based off the current firmware, kernel, initrd, and the kernel cmdline, and
-// the number of vcpus and their type
-func CalculateSEVESLaunchDigest(vcpus int, vcpuSig VCPUSig, firmwarePath, kernelPath, initrdPath, cmdline string) (res [sha256.Size]byte, err error) {
-	f, err := os.Open(firmwarePath)
-	if err != nil {
-		return res, err
-	}
-	defer f.Close()
-
-	digest := sha256.New()
-	if _, err := io.Copy(digest, f); err != nil {
-		return res, err
-	}
-
-	// When used for confidential containers in kata-containers, kernelPath
-	// is always set (direct boot).  However, this current package can also
-	// be used by other programs which may calculate launch digests of
-	// arbitrary SEV guests without SEV kernel hashes table.
-	if kernelPath != "" {
-		ht, err := constructSevHashesTable(kernelPath, initrdPath, cmdline)
-		if err != nil {
-			return res, err
-		}
-		digest.Write(ht)
-	}
-
-	o, err := NewOvmf(firmwarePath)
-	if err != nil {
-		return res, err
-	}
-	resetEip, err := o.sevEsResetEip()
-	if err != nil {
-		return res, err
-	}
-	v := vmsaBuilder{uint64(resetEip), vcpuSig}
-	for i := 0; i < vcpus; i++ {
-		vmsaPage, err := v.buildPage(i)
-		if err != nil {
-			return res, err
-		}
-		digest.Write(vmsaPage)
-	}
-
-	copy(res[:], digest.Sum(nil))
-	return res, nil
-}
--- a/src/runtime/pkg/sev/sev_test.go
+++ b/src/runtime/pkg/sev/sev_test.go
@@ -1,54 +0,0 @@
-// Copyright contributors to AMD SEV/-ES in Go
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sev
-
-import (
-	"encoding/hex"
-	"testing"
-)
-
-func TestCalculateLaunchDigestWithoutKernelHashes(t *testing.T) {
-	ld, err := CalculateLaunchDigest("testdata/ovmf_suffix.bin", "", "", "")
-	if err != nil {
-		t.Fatalf("unexpected err value: %s", err)
-	}
-	hexld := hex.EncodeToString(ld[:])
-	if hexld != "b184e06e012366fd7b33ebfb361a515d05f00d354dca07b36abbc1e1e177ced5" {
-		t.Fatalf("wrong measurement: %s", hexld)
-	}
-}
-
-func TestCalculateLaunchDigestWithKernelHashes(t *testing.T) {
-	ld, err := CalculateLaunchDigest("testdata/ovmf_suffix.bin", "/dev/null", "/dev/null", "")
-	if err != nil {
-		t.Fatalf("unexpected err value: %s", err)
-	}
-	hexld := hex.EncodeToString(ld[:])
-	if hexld != "d59d7696efd7facfaa653758586e6120c4b6eaec3e327771d278cc6a44786ba5" {
-		t.Fatalf("wrong measurement: %s", hexld)
-	}
-}
-
-func TestCalculateLaunchDigestWithKernelHashesSevEs(t *testing.T) {
-	ld, err := CalculateSEVESLaunchDigest(1, SigEpycV4, "testdata/ovmf_suffix.bin", "/dev/null", "/dev/null", "")
-	if err != nil {
-		t.Fatalf("unexpected err value: %s", err)
-	}
-	hexld := hex.EncodeToString(ld[:])
-	if hexld != "7e5c26fb454621eb466978b4d0242b3c04b44a034de7fc0a2d8dac60ea2b6403" {
-		t.Fatalf("wrong measurement: %s", hexld)
-	}
-}
-
-func TestCalculateLaunchDigestWithKernelHashesSevEsAndSmp(t *testing.T) {
-	ld, err := CalculateSEVESLaunchDigest(4, SigEpycV4, "testdata/ovmf_suffix.bin", "/dev/null", "/dev/null", "")
-	if err != nil {
-		t.Fatalf("unexpected err value: %s", err)
-	}
-	hexld := hex.EncodeToString(ld[:])
-	if hexld != "b2111b0051fc3a06ec216899b2c78da99fb9d56c6ff2e8261dd3fe6cff79ecbc" {
-		t.Fatalf("wrong measurement: %s", hexld)
-	}
-}
--- a/src/runtime/pkg/sev/testdata/README.md
+++ b/src/runtime/pkg/sev/testdata/README.md
@@ -1,9 +0,0 @@
-# sev/testdata
-
-The `ovmf_suffix.bin` contains the last 4KB of the `OVMF.fd` binary from edk2's
-`OvmfPkg/AmdSev/AmdSevX64.dsc` build.  To save space, we committed only the
-last 4KB instead of the the full 4MB binary.
-
-The end of the file contains a GUIDed footer table with entries that hold the
-SEV-ES AP reset vector address, which is needed in order to compute VMSAs for
-SEV-ES guests.
--- a/src/runtime/pkg/sev/testdata/ovmf_suffix.bin
+++ b/src/runtime/pkg/sev/testdata/ovmf_suffix.bin
--- a/src/runtime/pkg/sev/vcpu_sigs.go
+++ b/src/runtime/pkg/sev/vcpu_sigs.go
@@ -1,76 +0,0 @@
-// Copyright contributors to AMD SEV/-ES in Go
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sev
-
-type VCPUSig uint64
-
-const (
-	// 'EPYC': family=23, model=1, stepping=2
-	SigEpyc VCPUSig = 0x800f12
-
-	// 'EPYC-v1': family=23, model=1, stepping=2
-	SigEpycV1 VCPUSig = 0x800f12
-
-	// 'EPYC-v2': family=23, model=1, stepping=2
-	SigEpycV2 VCPUSig = 0x800f12
-
-	// 'EPYC-IBPB': family=23, model=1, stepping=2
-	SigEpycIBPB VCPUSig = 0x800f12
-
-	// 'EPYC-v3': family=23, model=1, stepping=2
-	SigEpycV3 VCPUSig = 0x800f12
-
-	// 'EPYC-v4': family=23, model=1, stepping=2
-	SigEpycV4 VCPUSig = 0x800f12
-
-	// 'EPYC-Rome': family=23, model=49, stepping=0
-	SigEpycRome VCPUSig = 0x830f10
-
-	// 'EPYC-Rome-v1': family=23, model=49, stepping=0
-	SigEpycRomeV1 VCPUSig = 0x830f10
-
-	// 'EPYC-Rome-v2': family=23, model=49, stepping=0
-	SigEpycRomeV2 VCPUSig = 0x830f10
-
-	// 'EPYC-Rome-v3': family=23, model=49, stepping=0
-	SigEpycRomeV3 VCPUSig = 0x830f10
-
-	// 'EPYC-Milan': family=25, model=1, stepping=1
-	SigEpycMilan VCPUSig = 0xa00f11
-
-	// 'EPYC-Milan-v1': family=25, model=1, stepping=1
-	SigEpycMilanV1 VCPUSig = 0xa00f11
-
-	// 'EPYC-Milan-v2': family=25, model=1, stepping=1
-	SigEpycMilanV2 VCPUSig = 0xa00f11
-)
-
-// NewVCPUSig computes the CPU signature (32-bit value) from the given family,
-// model, and stepping.
-//
-// This computation is described in AMD's CPUID Specification, publication #25481
-// https://www.amd.com/system/files/TechDocs/25481.pdf
-// See section: CPUID Fn0000_0001_EAX Family, Model, Stepping Identifiers
-func NewVCPUSig(family, model, stepping uint32) VCPUSig {
-	var family_low, family_high uint32
-	if family > 0xf {
-		family_low = 0xf
-		family_high = (family - 0x0f) & 0xff
-	} else {
-		family_low = family
-		family_high = 0
-	}
-
-	model_low := model & 0xf
-	model_high := (model >> 4) & 0xf
-
-	stepping_low := stepping & 0xf
-
-	return VCPUSig((family_high << 20) |
-		(model_high << 16) |
-		(family_low << 8) |
-		(model_low << 4) |
-		stepping_low)
-}
--- a/src/runtime/pkg/sev/vcpu_sigs_test.go
+++ b/src/runtime/pkg/sev/vcpu_sigs_test.go
@@ -1,21 +0,0 @@
-// Copyright contributors to AMD SEV/-ES in Go
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sev
-
-import (
-	"testing"
-)
-
-func TestNewVCPUSig(t *testing.T) {
-	if NewVCPUSig(23, 1, 2) != SigEpyc {
-		t.Errorf("wrong EPYC CPU signature")
-	}
-	if NewVCPUSig(23, 49, 0) != SigEpycRome {
-		t.Errorf("wrong EPYC-Rome CPU signature")
-	}
-	if NewVCPUSig(25, 1, 1) != SigEpycMilan {
-		t.Errorf("wrong EPYC-Milan CPU signature")
-	}
-}
--- a/src/runtime/pkg/sev/vmsa.go
+++ b/src/runtime/pkg/sev/vmsa.go
@@ -1,172 +0,0 @@
-// Copyright contributors to AMD SEV/-ES in Go
-//
-// SPDX-License-Identifier: Apache-2.0
-
-package sev
-
-import (
-	"bytes"
-	"encoding/binary"
-)
-
-// VMCB Segment (struct vmcb_seg in the linux kernel)
-type vmcbSeg struct {
-	selector uint16
-	attrib   uint16
-	limit    uint32
-	base     uint64
-}
-
-// VMSA page
-//
-// The names of the fields are taken from struct sev_es_work_area in the linux kernel:
-// https://github.com/AMDESE/linux/blob/sev-snp-v12/arch/x86/include/asm/svm.h#L318
-// (following the definitions in AMD APM Vol 2 Table B-4)
-type sevEsSaveArea struct {
-	es                  vmcbSeg
-	cs                  vmcbSeg
-	ss                  vmcbSeg
-	ds                  vmcbSeg
-	fs                  vmcbSeg
-	gs                  vmcbSeg
-	gdtr                vmcbSeg
-	ldtr                vmcbSeg
-	idtr                vmcbSeg
-	tr                  vmcbSeg
-	vmpl0_ssp           uint64   // nolint: unused
-	vmpl1_ssp           uint64   // nolint: unused
-	vmpl2_ssp           uint64   // nolint: unused
-	vmpl3_ssp           uint64   // nolint: unused
-	u_cet               uint64   // nolint: unused
-	reserved_1          [2]uint8 // nolint: unused
-	vmpl                uint8    // nolint: unused
-	cpl                 uint8    // nolint: unused
-	reserved_2          [4]uint8 // nolint: unused
-	efer                uint64
-	reserved_3          [104]uint8 // nolint: unused
-	xss                 uint64     // nolint: unused
-	cr4                 uint64
-	cr3                 uint64 // nolint: unused
-	cr0                 uint64
-	dr7                 uint64
-	dr6                 uint64
-	rflags              uint64
-	rip                 uint64
-	dr0                 uint64    // nolint: unused
-	dr1                 uint64    // nolint: unused
-	dr2                 uint64    // nolint: unused
-	dr3                 uint64    // nolint: unused
-	dr0_addr_mask       uint64    // nolint: unused
-	dr1_addr_mask       uint64    // nolint: unused
-	dr2_addr_mask       uint64    // nolint: unused
-	dr3_addr_mask       uint64    // nolint: unused
-	reserved_4          [24]uint8 // nolint: unused
-	rsp                 uint64    // nolint: unused
-	s_cet               uint64    // nolint: unused
-	ssp                 uint64    // nolint: unused
-	isst_addr           uint64    // nolint: unused
-	rax                 uint64    // nolint: unused
-	star                uint64    // nolint: unused
-	lstar               uint64    // nolint: unused
-	cstar               uint64    // nolint: unused
-	sfmask              uint64    // nolint: unused
-	kernel_gs_base      uint64    // nolint: unused
-	sysenter_cs         uint64    // nolint: unused
-	sysenter_esp        uint64    // nolint: unused
-	sysenter_eip        uint64    // nolint: unused
-	cr2                 uint64    // nolint: unused
-	reserved_5          [32]uint8 // nolint: unused
-	g_pat               uint64
-	dbgctrl             uint64    // nolint: unused
-	br_from             uint64    // nolint: unused
-	br_to               uint64    // nolint: unused
-	last_excp_from      uint64    // nolint: unused
-	last_excp_to        uint64    // nolint: unused
-	reserved_7          [80]uint8 // nolint: unused
-	pkru                uint32    // nolint: unused
-	reserved_8          [20]uint8 // nolint: unused
-	reserved_9          uint64    // nolint: unused
-	rcx                 uint64    // nolint: unused
-	rdx                 uint64
-	rbx                 uint64    // nolint: unused
-	reserved_10         uint64    // nolint: unused
-	rbp                 uint64    // nolint: unused
-	rsi                 uint64    // nolint: unused
-	rdi                 uint64    // nolint: unused
-	r8                  uint64    // nolint: unused
-	r9                  uint64    // nolint: unused
-	r10                 uint64    // nolint: unused
-	r11                 uint64    // nolint: unused
-	r12                 uint64    // nolint: unused
-	r13                 uint64    // nolint: unused
-	r14                 uint64    // nolint: unused
-	r15                 uint64    // nolint: unused
-	reserved_11         [16]uint8 // nolint: unused
-	guest_exit_info_1   uint64    // nolint: unused
-	guest_exit_info_2   uint64    // nolint: unused
-	guest_exit_int_info uint64    // nolint: unused
-	guest_nrip          uint64    // nolint: unused
-	sev_features        uint64
-	vintr_ctrl          uint64 // nolint: unused
-	guest_exit_code     uint64 // nolint: unused
-	virtual_tom         uint64 // nolint: unused
-	tlb_id              uint64 // nolint: unused
-	pcpu_id             uint64 // nolint: unused
-	event_inj           uint64 // nolint: unused
-	xcr0                uint64
-	reserved_12         [16]uint8   // nolint: unused
-	x87_dp              uint64      // nolint: unused
-	mxcsr               uint32      // nolint: unused
-	x87_ftw             uint16      // nolint: unused
-	x87_fsw             uint16      // nolint: unused
-	x87_fcw             uint16      // nolint: unused
-	x87_fop             uint16      // nolint: unused
-	x87_ds              uint16      // nolint: unused
-	x87_cs              uint16      // nolint: unused
-	x87_rip             uint64      // nolint: unused
-	fpreg_x87           [80]uint8   // nolint: unused
-	fpreg_xmm           [256]uint8  // nolint: unused
-	fpreg_ymm           [256]uint8  // nolint: unused
-	unused              [2448]uint8 // nolint: unused
-}
-
-type vmsaBuilder struct {
-	apEIP   uint64
-	vcpuSig VCPUSig
-}
-
-func (v *vmsaBuilder) buildPage(i int) ([]byte, error) {
-	eip := uint64(0xfffffff0) // BSP (first vcpu)
-	if i > 0 {
-		eip = v.apEIP
-	}
-	saveArea := sevEsSaveArea{
-		es:           vmcbSeg{0, 0x93, 0xffff, 0},
-		cs:           vmcbSeg{0xf000, 0x9b, 0xffff, eip & 0xffff0000},
-		ss:           vmcbSeg{0, 0x93, 0xffff, 0},
-		ds:           vmcbSeg{0, 0x93, 0xffff, 0},
-		fs:           vmcbSeg{0, 0x93, 0xffff, 0},
-		gs:           vmcbSeg{0, 0x93, 0xffff, 0},
-		gdtr:         vmcbSeg{0, 0, 0xffff, 0},
-		idtr:         vmcbSeg{0, 0, 0xffff, 0},
-		ldtr:         vmcbSeg{0, 0x82, 0xffff, 0},
-		tr:           vmcbSeg{0, 0x8b, 0xffff, 0},
-		efer:         0x1000, // KVM enables EFER_SVME
-		cr4:          0x40,   // KVM enables X86_CR4_MCE
-		cr0:          0x10,
-		dr7:          0x400,
-		dr6:          0xffff0ff0,
-		rflags:       0x2,
-		rip:          eip & 0xffff,
-		g_pat:        0x7040600070406, // PAT MSR: See AMD APM Vol 2, Section A.3
-		rdx:          uint64(v.vcpuSig),
-		sev_features: 0, // SEV-ES
-		xcr0:         0x1,
-	}
-	page := new(bytes.Buffer)
-	err := binary.Write(page, binary.LittleEndian, saveArea)
-	if err != nil {
-		return []byte{}, err
-	}
-	return page.Bytes(), nil
-}
--- a/src/runtime/virtcontainers/hypervisor_linux_amd64.go
+++ b/src/runtime/virtcontainers/hypervisor_linux_amd64.go
@@ -10,8 +10,6 @@ import "os"
 const (
 	tdxKvmParameterPath = "/sys/module/kvm_intel/parameters/tdx"

-	sevKvmParameterPath = "/sys/module/kvm_amd/parameters/sev"
-
 	snpKvmParameterPath = "/sys/module/kvm_amd/parameters/sev_snp"
 )

@@ -30,12 +28,6 @@ func availableGuestProtection() (guestProtection, error) {
 			return snpProtection, nil
 		}
 	}
-	// SEV is supported and enabled when the kvm module `sev` parameter is set to `1` (or `Y` for linux >= 5.12)
-	if _, err := os.Stat(sevKvmParameterPath); err == nil {
-		if c, err := os.ReadFile(sevKvmParameterPath); err == nil && len(c) > 0 && (c[0] == '1' || c[0] == 'Y') {
-			return sevProtection, nil
-		}
-	}

 	return noneProtection, nil
 }
--- a/src/runtime/virtcontainers/pkg/rootless/rootless.go
+++ b/src/runtime/virtcontainers/pkg/rootless/rootless.go
@@ -38,7 +38,10 @@ var (

 	// XDG_RUNTIME_DIR defines the base directory relative to
 	// which user-specific non-essential runtime files are stored.
-	rootlessDir = os.Getenv("XDG_RUNTIME_DIR")
+	rootlessDir string
+
+	// Used for lazy initialization of rootlessDir
+	rootlessDirOnce sync.Once

 	rootlessLog = logrus.WithFields(logrus.Fields{
 		"source": "rootless",
@@ -82,5 +85,9 @@ func isRootlessFunc() bool {
 // GetRootlessDir returns the path to the location for rootless
 // container and sandbox storage
 func GetRootlessDir() string {
+	rootlessDirOnce.Do(func() {
+		rootlessDir = os.Getenv("XDG_RUNTIME_DIR")
+		rootlessLog.WithField("rootlessDir", rootlessDir).Debug("initialized rootlessDir")
+	})
 	return rootlessDir
 }
--- a/src/tools/agent-ctl/Cargo.lock
+++ b/src/tools/agent-ctl/Cargo.lock
--- a/src/tools/agent-ctl/Cargo.toml
+++ b/src/tools/agent-ctl/Cargo.toml
@@ -13,7 +13,7 @@ license = "Apache-2.0"
 [dependencies]
 protocols = { path = "../../libs/protocols", features = ["with-serde"] }
 rustjail = { path = "../../agent/rustjail" }
-oci-spec = { version = "0.6.8", features = ["runtime"] }
+oci-spec = { version = "0.8.1", features = ["runtime"] }

 clap = { version = "4.5.40", features = ["derive", "cargo"] }
 lazy_static = "1.4.0"
--- a/src/tools/genpolicy/Cargo.lock
+++ b/src/tools/genpolicy/Cargo.lock
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .18.0
 .19.1